I’ve nothing to add to the BA hacking saga, but feel free to add your comments here

This article is closed to new comments. Feel free to ask your question in the HfP forums.

• YL says:

  28 Mar28 March 14:04

  I am also a member of 0 Avios club!
  My BA password is unique and I used my BAEC number to log in….however, I do use AwardWallet.
  So far I have received no email, but was able to reset my password to log on to my account.
  I am waiting for the CX award seats to open up next week, this is really annoying!

• Nick says:

  28 Mar28 March 14:13

  Locked out, no email. 50 minutes on hold to them today to sort it out.

  The call centre staff in the UK are excellent – up there with Amex. The other call centre however…. oh dear.

  Fed up wit BA, really. It is just so painfully difficult to work with them, even when you are trying to give them money. Happlily, my mood improved significantly by booking those Qatar flights to Bangkok for me and the wife for under £1600 in total. Amazing, in particular when you consider that we get Silver status thrown in (which saves us £600 in seat booking fees) and about £300 of Avios, too. My main concern is that sampling the 1-2-1 biz setup on Qatar will make our CW flights to Sydney with BA a month or so later seem a bit naff.

• RIccati says:

  28 Mar28 March 14:17

  I have read all 28+ pages of Flyertalk forum.

  Yet to find any one report from someone being actually ‘hacked’.

  A lot of comment from BA call centre that their fraud team ‘overreacted’. They really SHOULD think about impact of their actions, especially at this sensitive time (devaluation). How would those people who purchased Avios on 50% offer this week feel when they discover they can’t access it?

  • Cv3v says:

    28 Mar28 March 14:27

    Good point. With the upcoming avios devaluation these account suspensions are happening at a particularly bad time.

    Glad I’ve blown almost all my avios flying on other oneworld carriers.

    • Nick says:

      29 Mar29 March 20:15

      If BA senior staff are reading this they should really consider putting back the devaluation by a month or two to give loyal customers some confidence in their airline.

      • Fenny says:

        30 Mar30 March 01:00

        If BA senior staff are reading this, why aren’t they doing something about the issue! They don’t give a stuff about the timing and will probably not give a stuff if people can’t book the flights they want because of it.

  • Richard says:

    28 Mar28 March 14:44

    “They really SHOULD think about impact of their actions”

    Well, if we’re thinking through consequences, shall we think through the consequences if they HADN’T locked your account? I see no reason not to assume that the email is telling the truth, and someone did manage to log onto your account, even though they didn’t do anything.

    So, are you happy with the fact that some unknown and malicious person can see your future bookings? Know exactly when you’re going to be away from home? See all your contact details, passport number and passport expiry date – everything they’d need to clone your identity? Cancel your bookings or change your flights, if they’re feeling mischievous?

    Luckily, it seems none of that happened – that’s why they say “we are not aware of any access to any subsequent information pages within your account”. But it could have happened at any moment, which is why they had to stop it.

    And remember, it’s not BA’s fault. THEY didn’t leak your password. Someone else did.

    • RIccati says:

      28 Mar28 March 14:53

      We are yet to see any one report from someone being actually ‘hacked’.

      I see that email from BA as vaguely worded, serving no purpose and making misrepresentations. That ‘someone’ who logged into my account could be Awardwallet robot who filled the login form.

      Given the blanket way the accounts got blocked, we will never know if there were specific, actual breaches.

      By the way the whole Household account was blocked (all but one users) I know it has nothing to do with passwords.

    • Liz says:

      28 Mar28 March 15:24

      Hi Richard, what do you think has happened to my account. My BAEC account has not locked me out and my household account miles are all intact but our profiles seem to have lost 40% of our information. The advance passenger information ie. passport information is all gone from our profiles. Upcoming flights etc are all still intact too. We’ve not received any email from BA.

      • Richard says:

        28 Mar28 March 16:18

        I don’t think you need to worry. It sounds like they’ve been active in locking out any accounts which have been compromised, so if yours hasn’t been locked then I would guess there is no suspicious activity on it. Maybe that’s because you’ve been security-conscious and haven’t used the same password all over the web!

        The fact that the some information has vanished from your profile is odd, but it wouldn’t worry me personally. I don’t see any reason why a hacker would do it – it wouldn’t serve any benefit for them, and would just call attention to themselves. I think it’s much more likely that there’s an innocent explanation (maybe it gets reset if you do something-or-other, and you’ve only just noticed).

        Bottom line: nobody can be 100% certain, but in your position I wouldn’t be concerned. It never hurts to change your password of course, so maybe do that – to one which you’ve never used anywhere else.

        • Michalis says:

          28 Mar28 March 17:35

          I use randomly generated 16+ character passwords for my accounts. I don’t use the same password anywhere and yet mine was also locked.

          The way this is handled is a farse. If you think you are hacked then by all means reset the passwords and sent an email to all affected members. Removing the avios and not sending anything is frankly bullshit but I guess not surprising. After all I wouldn’t expect their IT to be better than their product.

    • Paul says:

      28 Mar28 March 15:39

      No one was hacked. BA were attacked, and they overreacted by locking thousands of customers out of their accounts. and zeroing their balances with a ludicrous Ex gratia comment.
      No one is saying they should have done nothing but they are supposed to be a customer service business. The email was inept and looked false; the contingency does not work i.e. how to reset and the lack of information on the web site a disgrace.
      Blaming others in the opaque manner they did was contemptible and I hope award wallet and others challenge that appropriately.

      • Richard says:

        28 Mar28 March 16:22

        “Blaming others in the opaque manner they did was contemptible and I hope award wallet and others challenge that appropriately.”

        They didn’t. Eveyone else jumped to the conclusion about Award Wallet.

        The email is badly phrased, I admit. But when they said “We understand this was login information relating to a different online service which you may have also used to access your Executive Club account”, I don’t think they meant that you used the “different online service” to access your BAEC account. I think they meant that you used the “login information relating to a different online service” to access your BAEC account – in other words, used the same password as you’d used somewhere else, possibly somewhere completely unconnected to air travel.

        • susan says:

          29 Mar29 March 20:36

          I use a BAEC-specific password and have had the three accounts in my HA zeroed. As yet no email from BA to any of the accounts. So if BA is saying that it’s our fault for using the same password on multiple online services then they are talking b*ll*cks.

• Andy says:

  28 Mar28 March 14:22

  They have a message when you phone now explaining it all and saying the Avios will be credited back to our accounts in the “coming days”.

• idrive says:

  28 Mar28 March 14:30

  i am locked out as of this morning, yesterday access to ba.com was fine. I use AW, i use EXEC # to get in.

  HAVE YOU ALSO being locked out of IBERIA?? i managed to reset the PIN and i gained access to my IB account immediately with correct Avios Balance.
  Though the below wording on screen:

  PIN update
  From 27/03/15 to 15/04/15

  For security reasons, if you have not done so recently please change your PIN to log in to your Personal Area on Iberia Plus.
  Please, check that your personal information is correct.

  makes me think they really got into big trouble with some hacking action…

  i am now trying to find the way to gain access to my BA as I NEEEED to book multiple flights INCLUDING Easter for which i found a seat. I am in big trouble otherwise.

  • david cliff says:

    28 Mar28 March 14:35

    Out of curiosity, i went to my Iberia account, and got the exact same wierd message, Ive had to enter yet ANOTHER new password ! I tend to agree, there is something big going on behind the scenes !

  • idrive says:

    28 Mar28 March 14:40

    I managed to reset my BA account with a new password. got email quoting account# and Avios balance 0 will call to reinstate it…arghh account shows “Ex-gratia” too..

    while accessing accounts with AW after password reset, Iberia says something like:

    “it is not currently possible to update the account on a mobile version at present please log in with a desktop”
    on a desktop version it won’t allow me to update accounts unless i install the chrome plugin which i am NOT willing to do.

• DAC says:

  28 Mar28 March 14:30

  can you imagine if the airline industry was governed by the FCA – there would be fines, hearings and action. As it is, nothing will happen to BA for this incompetent action –

  • RIccati says:

    28 Mar28 March 14:46

    Exactly. If the service is insecure they should have shut it down until it is. I.e., if there were massive multiple log in attempts across many accounts.

    If individual accounts got compromised, they should have received definite emails explaining that.

    By sending out vague emails like one above “This appears to have been…”, BA is making misrepresentation.

    Blocking accounts in a blanket way is a woeful approach. Now we don’t know whether a particular account was breached and one should generate a unique password for BA or it was an ‘over-reaction’ and the account was and is really fine.

• idrive says:

  28 Mar28 March 14:30

  ah, and got no email from BA!

• Andy says:

  28 Mar28 March 14:50

  Can I suggest we all calm down a touch – all this ranting and raving about incompetent action… please? These things happen sometimes and we’d all be complaining if our accounts were actually fraudulently accessed. Its probably a bit of a wake up call to be honest.

  I just phoned the silver line and they said they aren’t actually as busy as they expected to be – was about a 10 minute wait. No problem – just put the phone onto speak. Very polite and extremely apologetic. Asked some extra security questions and then my account will be sent for prioritised audit.

  • RIccati says:

    28 Mar28 March 15:01

    Fighting fraud does not mean that bank accounts for all of your family must be locked and all funds withdrawn ‘until further notice’.

    It means preventing specific fraudulent transactions and that is what BA should have been doing instead of carpet bombing.

    • Richard says:

      28 Mar28 March 16:43

      “Fighting fraud does not mean that bank accounts for all of your family must be locked and all funds withdrawn ‘until further notice’. ”

      Rubbish. I’ve had all the cards on my Amex account cancelled before now, because someone had skimmed the number of one of them. Until I got new ones I was essentially locked out of the account. It was inconvenient, but it’s necessary, and standard practice.

      • Liz says:

        28 Mar28 March 16:59

        We had a fraud on our Tesco mastercard about a month ago – we also got frozen out for about a week until new cards arrived in the post – but at least they picked up the fraud on the very first transaction – someone tried to use our card in New York!

      • RIccati says:

        29 Mar29 March 15:48

        Well this is a rubbish situation. AMEX gives an option of A.C. card to Platinum Cardholders. It has a different number, expiry and CVV. It remains unused until necessary.

  • Andy says:

    28 Mar28 March 15:03

    Frankly we don’t know the facts yet do we? And pretty obviously this isn’t the same as a bank account.

    This might make us all smile…
    http://www.youtube.com/watch?v=WCqm4H3m3Ew

    • RIccati says:

      28 Mar28 March 15:17

      About facts: I have browsed all 28 pages of Flyertalk thread on the issue and yet to see a report from someone who has actually been ‘hacked’/compromised.

      Either you accept that Avios are a property or not. If we accept the ownership of Avios (whatever they are), then it’s no different from funds in bank account. The bank could only stop delivering on your account, if it is bankrupt.

      • Think Square says:

        28 Mar28 March 16:02

        A small number of people do seem to have been actually hacked – unsolicited hotel bookings made with their Avios. See the comments when Rob first reported this on Monday

        https://headforpoints.com/2015/03/23/british-airways-avios-account-hacked/

        • RIccati says:

          29 Mar29 March 15:50

          Can you make Avios hotel booking via ba.com?

        • Pr99 says:

          30 Mar30 March 06:50

          it links to BA branded site managed by Avios.com. Same choice of hotel and prices but a choice of transaction currencies.

  • YL says:

    28 Mar28 March 16:42

    Sadly getting through the blue line do take much longer:-(

This article is closed to new comments. Feel free to ask your question in the HfP forums.