I’ve nothing to add to the BA hacking saga, but feel free to add your comments here

This article is closed to new comments. Feel free to ask your question in the HfP forums.

• Johnny5a says:

  28 Mar28 March 12:46

  My whole family are not affected. Looking at the awardwallet statement and talking to others about this, seems like those who are affected use username/email address to login.

  I’ve found the people who are not affected are those who use their EC number to login.

  • Alan says:

    28 Mar28 March 12:49

    Sorry but need to dash that theory – both myself and a friend both only use BAEC numbers as ID for logging in and both of us have had our accounts zeroed.

    • david cliff says:

      28 Mar28 March 14:17

      Me too, I use my Exec number to log in and a random made-up password (not an e-mail or any kind of username) and my account has been suspended. Im a little annoyed as I was not contacted bt BA about this, and i’ve just spent a rather frustration 40mins on the phone to get the link sent to me to re-set my password.

      • Johnny5a says:

        29 Mar29 March 07:20

        Further discussions with friends who have been affected by this.

        My family can only login using our exec numbers, not email not username.

        Turns out some accounts can use either exec numbers or email address or a username

  • Kevin says:

    28 Mar28 March 12:51

    My whole family use EC number to log in and AW. All four have been locked out.

    • Phillip says:

      29 Mar29 March 07:24

      Ditto!

• Save East Coast Rewards says:

  28 Mar28 March 12:49

  On a positive note my BA account has been unaffected which is good because I want to spend some Avios.

  Hopefully those that are wanting to spend will get their issues sorted out soon.

• Andy says:

  28 Mar28 March 12:50

  locked out of my account and haven’t had an email from BA.

  • Raymond Hennessy says:

    28 Mar28 March 12:59

    I use a BAEC # to log in and have been locked out. Have not received an e-mail from BA and have tried to reset my password, but also have not received an e-mail for this(no problem with my e-mail as I receive plenty of marketing guff from BA).
    Have no particular need for accessing my account right now,so will leave it till next week and see if it resolves itself.

    • John says:

      28 Mar28 March 13:01

      I tried resetting my password last night, but no email came. I did it again first thing this morning when they were less busy and the email came instantly.

  • Andrew (@andrewseftel) says:

    28 Mar28 March 13:31

    I’m also locked out, no email.

    Amazing what you can get away with in other industries. Banks would be in big trouble with the FCA!

  • Think Square says:

    28 Mar28 March 13:39

    I wouldn’t be surprised if many of the (near-identical) emails have been eaten by spam filters.

    Mrs Square got the original email but her password reset email hasn’t turned up.

  • david cliff says:

    28 Mar28 March 14:18

    I didnt get one either.

• John says:

  28 Mar28 March 12:58

  Locked out, Avios total zeroed and no email from BA.

  It’s a total shambles the way it’s being handled. Not even a mention of it on their web site. No wonder their phone lines are at meltdown!

• Gordon says:

  28 Mar28 March 13:08

  I managed to get though on the phone and they took me through the usual verification of name, address, dob etc. They told me the points would be reinstated before the end of the day. I seriously cant see that happen but lets wait and see

  • Carl says:

    28 Mar28 March 13:11

    I was told the same yesterday morning, when I noticed my Avios was taken “ex gratia”.

    An hour later I couldn’t log in at all. Thought it was just my account, clearly not.

  • david cliff says:

    28 Mar28 March 14:20

    Really ? I have just been advised it will be 7-14 days to get my points re-instated !!

• Marko says:

  28 Mar28 March 13:11

  I have been told that after a password change it will typically take 5 working date to reinstall the points. However, award transactions will be possible via phone free of charge. The phone lines are incredibly busy.

  I personally find it good that BA information security acts that proactive and deals with a breach of a third party so effective. Please be nice to the people in the call centre!

  • RIccati says:

    28 Mar28 March 14:27

    They should really have thought the consequences. I.e., they could have blocked suspicious redemptions (such as when credit card not in the name of account holder) and then dealt with specific cases IF there were any actual breach.

    I am yet to see anyone to report being actually ‘hacked’, here or on Flyertalk.

• Peter says:

  28 Mar28 March 13:12

  Locked out. No email.

  Tried to change password, but each time I try I get an error.

  No rush to use points so going to sit it out…

  • James says:

    29 Mar29 March 17:39

    No email here either.. It is pretty bad that this has happened without a word from BA. So long as they are back in time to book redemptions before April 28th 🙂

    • David BS says:

      30 Mar30 March 00:15

      Same here. It would be helpful if a general update was posted by BA since so many affected. Customer service?

• Richard says:

  28 Mar28 March 13:39

  The phrasing of the email from BA is a bit confusing – but as an IT professional in a previous life, I can make a fairly confident guess at what’s happened.

  Lots of people (I’m sorry to say, myself included) use the same password for several completely different websites. For example, my BA password is the same one as I use to log into the Guardian website. I shouldn’t re-use passwords like that, and I certainly shouldn’t admit it in public, but almost everyone does.

  Occasionally a website gets hacked (for example, LinkedIn was notoriously hacked a couple of years ago), and a whole load of email addresses and passwords get leaked. The affected website – LinkedIn in that example – fixes the problem on their own site by forcing everyone to change their passwords. But if you’ve used the same email address and password on other websites, then your account on those websites is compromised, because your password is now out in the open.

  Of course, there’s no easy way for anyone to *know* that you’ve used the same password on (in this case) the BA website. But a hacker who wants to attack BA accounts can just get a big long list of compromised email addresses and passwords, and try them one by one. Occasionally they’ll get lucky.

  My reading of BA’s email is that this last bit has just happened. So the email addresses and passwords might have been leaked a long time ago, possibly from hacking attacks against a variety of different websites. Most likely, those websites had nothing whatever to do with air travel. But recently, someone thought to try all these leaked combinations on the BA site; BA have noticed that happening and (very rightly) taken action.

  So, please everyone, let’s not go overboard being outraged. It’s annoying, but I think they’re handling it very well.

  Oh, and on the point that you can still be locked out even if you use your BAEC number to log in… BA does know your email address though. So they might have decided to err on the safe side, and lock your account if the attacker tried to log on using your email address and correct password. The login wouldn’t have worked, but it would still demonstrate that your password was compromised and ought to be changed. Again, if that *is* what’s happened, then BA have done exactly the right thing.

  • RIccati says:

    28 Mar28 March 14:54

    Except for the small ridiculous fact that ba.com password reset accepts the old password to be set as new!

    • Paul says:

      28 Mar28 March 18:18

      Many IT systems don’t keep a password history, just the current one. I don’t know how BA locked the accounts but they may have done it by deleting the current password (so the password reset system wouldn’t know it was different).

      Their reset system may not have been designed with possibly hacked accounts in mind. Personally I find it frustrating when systems refuse to let you use a password you have in the past.

  • Paul says:

    28 Mar28 March 15:31

    Am sorry but cannot agree. Avoid is a currency and as such should have been protected by BA in the same way my bank protects my money. American Express when they detect anything unusual call me, my bank send s text messages and each provide clear concise information on how to fix things.
    BA sent an anonymous email dressed to “dear customer” in which they blamed a 3rd party. Many took that to Award Wallet who have now responded. It looks and feels like the type of email you should delete which is what I did. Once it became clear the problems was huge, i followed the reset process which did not work. I called this morning and got cut off so busy are the lines. When I did get through the 1st agent was clueless, genuinely did not know what was going on or how massive the issue was. The second was helpful but was unable to generate a rest email. You cannot book a flight even via the phone until the account is unlocked and without the reset email you cannot do that. The best she could offer was to pass my details along to the Monday to Friday teams with absolutely no indication of when I might have access again.
    This is a farce and they have learned nothing from Sony or other high profile incidents. They appear to have panicked and certainly do not have any proper contingency planning or business continuity in place. They have shut it down and will simply ride out the storm.
    I think that is unacceptable and far from going over board, I think I have every reason to be annoyed that they cannot protect my data and account. A reset process that does not work and when it does allows the same password is surely unfit for purpose and we should be both concerned and annoyed

    • Richard says:

      28 Mar28 March 16:32

      “Avoid is a currency and as such should have been protected by BA in the same way my bank protects my money”

      They have. Try typing the wrong password into your bank website a few times, and see what happens. When I did (completely through my own incompetence), they locked the account and I had to wait until they’d sent me something through the post to re-activate it – which isn’t a million miles away from what’s happened here.

      Yes, it is poor that they let you reset your password to the same thing; they ought to protect us from our own laziness. Do I give them a slap on the wrist for that – yes. Am I shocked, horrified, scandalised, fearful, cutting up my BAEC card and swearing never ever to fly with them again – no.

    • Pol says:

      28 Mar28 March 16:51

      There is no excuse for the lack of communication though. I, like many others have not received an email or any other communication about the problem. I simply get an invalid username/password message when logging in. Would it really be so difficult to place a notice on the BA site or a messege when you phone to explain the problem.

    • Paul says:

      28 Mar28 March 18:14

      * I am a different Paul

      I agree with Richard that many people are overreacting here. Obviously we don’t know the details but I think we should at least give BA chance to fix whatever caused the problem.

      RIccati below says no one on FlyerTalk has been hacked, but how would they know? If BA caught the hackers and stopped it there may be no evidence visible to us.

      Keep in mind that BA probably had to act fast to stop the breach if it was costing them money (ie, avios was being redeemed). My guess is they spotted real suspicious activity, and as a precaution blocked all accounts logged in via an automated routine. At that point they may not have been aware of how the login details were stolen, and AwardWallet may have appeared to be a common link. I can understand why BA may be worried about services like AwardWallet. A single site with a large number of their customers details (worse, most of the users of AW will likely be heavy avios users!). It will be a nightmare for them if it ever does get hacked.

      I admit they could be handling this a bit better, e.g. a message on the login page. But who knows how easy that is to update. Even if it isn’t technically difficult, they may have procedures that make it difficult to make the change quickly without risking breaking anything.

      “Avoid is a currency and as such should have been protected by BA in the same way my bank protects my money”
      If BA do fix everyones accounts then they have protected your avios. You not being able to access it for a few days is not the same as them not protecting it.

This article is closed to new comments. Feel free to ask your question in the HfP forums.