British Airways’ Website and App Hit By “Malicious Criminal Attack”

British Airways faces another public relations nightmare as the company has advised that their mobile app and website were the target of a cyber breach which has compromised personal data, specifically the payment card information, of at least 380,000 customers. The breach was announced on Thursday and customers affected are those who made or changed bookings on the company’s platforms over a 15-day period between 21:58 GMT on August 21 and 20:45 GMT on September 5.

British Airways CEO Alex Cruz issued an apology and appeared on various media on Friday to apologize further for the “very sophisticated malicious criminal attack.” Cruz reassured customers that the sites were now secure and investigations were underway as to how the criminals accessed the payment card information of the customers, which included the three-digit CVV number on the back of credit and debit cards.

The CVV is legally not allowed to be stored by companies which is of particular concern in the investigation. Also of concern is the length of time that the harvesting of customer details was able to continue for over two weeks, with the airline only noticing something was awry on Wednesday night and concluding the serious extent of the criminal activity on Thursday.

Emirates President Sir Tim Clark was speaking at the annual Aviation Festival in London on Friday and offered his rivals some words of consolation saying that BA was dealt a “dose of bad luck.” Sir Tim added that airlines can expect further breaches as digital transformation of the business increases. He added, “At Emirates we have strengthened and added resources to the cyber security units. The fact is if you do not spend time and money you are going to be hugely exposed.”

IT news site The Register quoted an unnamed expert as saying the cause of the breach may “probably come down to either not having an update tested before it goes live, cost-cutting resulting in the site not being tested as often as it should have been or lower quality support (aka not patching the servers).” The site also reported that on August 1 BA’s Group IT Service Effectiveness Manager had advised staff that management had approved a proposal to outsource the airline’s cyber security to IBM and that a consultation process with affected staff would be initiated. BA has been under scrutiny in the last few years for the cost-cutting measures and business model changes which have been implemented across the airline under Cruz.

With regard to those customers affected by the breach, Alex Cruz told the BBC that “we will compensate them for any financial hardship that they may have suffered.” What that compensation will be is yet to be determined with BA customers taking to social media to express their anger and frustration against the airline.

Some customers are relating stories of being stranded in foreign countries without access to funds as their banks have advised them to cancel their payment cards. Further concern is being raised of the opportunities the criminals have to use the data obtained in a myriad of fraudulent practices such as creating fake accounts with other companies.

In the UK, the incident is also being investigated by the Information Commissioner’s Office; the National Crime Agency; and National Cyber Security Centre. If BA is found to be in breach of recent EU GDPR legislation, introduced in May, they may face a fine equivalent to four percent of their annual global revenue. For the airline, this would equate to £489m in addition to the passenger compensation.

When attempting to access BA’s online Media Center on Friday afternoon to retrieve further updates on the situation, users are prevented from doing so and faced with a ‘Privacy Error’ message which reads “Attackers might be trying to steal your information from mediacentre.britishairways.com (for example, passwords, messages or credit cards).”

• Author
• Recent Posts

John Flett

John has always had a passion for aviation and through a career with Air New Zealand has gained a strong understanding of aviation operations and the strategic nature of the industry.

During his career with the airline, John held multiple leadership roles and was involved in projects such as the introduction of both the 777-200 and -300 type aircraft and the development of the IFE for the 777-300. He was also part of a small team that created and published the internal communications magazines for Air New Zealand’s pilots, cabin crew and ground staff, balancing a mix of corporate and social content.

John is educated to postgraduate level achieving a Masters degree with Distinction in Airline and Airport Management. He has been the course director of an undergraduate commercial pilot training programme at a leading London university and a member of Heathrow Community Trust’s ‘Communities for Tomorrow’ panel.

John is currently living in Canada and is contracted as an external instructor for aviation-related organizations.

Latest posts by John Flett (see all)

• IAG-Air Europa Deal May Have ‘Negative Effect on Competition’ - April 26, 2024
• Fiji Airways, Porter Airlines Sign Interline Agreement - April 20, 2024
• Airlines Amend Schedules to Avoid Iranian Airspace - April 14, 2024