Maximise your Avios, air miles and hotel points

British Airways admits massive data breach including theft of credit card numbers

Links on Head for Points may pay us an affiliate commission. A list of partners is here.

Friday 1pm update:  Various reports in our comments and elsewhere suggest that – despite BA statements – people who have booked via telephone and with BA Holidays are receiving emails saying their details are compromised.  There are also other people like myself who made redemption bookings who have not received any email.  It is probably best to assume that any transaction you’ve made which led to a BA credit card charge is likely to be at risk

Friday 12.30pm update:  IAG’s share price is down 3.6% so far today as investors worry about compensation payments and the impact on future bookings.  The overall market is only down 1.0%.

Friday 11.30am update:  It is worth noting that now says “The personal and financial details of customers making or changing bookings on and the airline’s mobile app were compromised.”  This means that you might be affected even if you did not purchase a ticket during this period.

The official page with more information is here.

Friday 10am update:  I get two paragraphs in the Daily Telegraph today, both website and newspaper – see here.  The Alex Cruz interview on Radio 4 this morning confirms that the following data has been stolen:

  • email address
  • postal address
  • credit card number
  • expiration data
  • CVV

Your frequent flyer and passport data has not been impacted as that is not transmitted during the payment process.

On the upside, there is no sign of the vest yet:

I just realised that I have not received the BA email, even though I made a redemption booking on 3rd September.  Whilst this was an Avios booking, I paid taxes on a credit card and the payment process is the same as for a cash booking.

Friday 9.30am update:  BA appears to be in breach of ICO guidelines in its email to affected customers.  To quote from the ICO website:

“You need to describe, in clear and plain language, the nature of the personal data breach and, at least:

  • the name and contact details of your data protection officer (if your organisation has one) or other contact point where more information can be obtained;
  • a description of the likely consequences of the personal data breach; and
  • a description of the measures taken, or proposed to be taken, to deal with the personal data breach and including, where appropriate, of the measures taken to mitigate any possible adverse effects.”

Friday 9am update:  This breach is ONLY related to transactions made online at, not or BA Holidays it seems. This implies that BA may not have been encrypting payment details when they were sent to their payment processor and someone was picking them up on the way. You are at NO risk if you have a credit card stored at but did not make a purchase during this 2-week period.

Friday 8am update: It now appears that 380,000 transactions have been compromised.  You should have received an email overnight if you are included. There are no reports so far of card fraud linked to the breach and credit card companies are NOT replacing cards automatically. If you are nervous, you can report your Amex card as ‘lost’ via the website and it will be replaced.


The following press release just turned up from British Airways five minutes ago, for your information:


September 06, 2018

“British Airways is investigating, as a matter of urgency, the theft of customer data from its website, and the airline’s mobile app. The stolen data did not include travel or passport details.

From 22:58 BST August 21 2018 until 21:45 BST September 5 2018 inclusive, the personal and financial details of customers making bookings on and the airline’s app were compromised.

The breach has been resolved and our website is working normally.

British Airways is communicating with affected customers and we advise any customers who believe they may have been affected by this incident to contact their banks or credit card providers and follow their recommended advice.

We have notified the police and relevant authorities.

Alex Cruz, British Airways’ Chairman and Chief Executive said “We are deeply sorry for the disruption that this criminal activity has caused. We take the protection of our customers’ data very seriously.”

British Airways will provide further updates when appropriate.”

Coming just a week after the high profile launch of the September sale – bookings for which have been caught up in this – the timing could not be worse.

I feel a bit sorry for British Airways at the moment.  They have spent the last year reversing the cut-backs of 2016 (the changes to Club Europe catering on the 12th are almost the final piece of the jigsaw) but there is no sign of public perception improving.  Good news, of course, makes for less interesting press coverage than bad news, which is why coming back from bad publicity is always hard.

Following on from the IT outage from last year, this theft is likely to raise more questions about the decision to move much of BA’s IT infrastructure to India.  Whatever money it saved will be peanuts compared to the costs of dealing with this breach.

And, given that I made a couple of redemptions last week, it looks like I’m going to need a new British Airways American Express card ….

The official BA web page discussing the leak and what you should do is here.

(Want to earn more Avios?  Click here to visit our home page for the latest articles on earning and spending your Avios points and click here to see how to earn more Avios from current offers and promotions.)

Comments (266)

  • Richard says:

    Surely most HfP readers would have closed and churned the card used by now anyway!

  • Dwb1873 says:

    How confident are you Rob that your own third party content providers are secure?

    I know you don’t take card details but the premise – that any part of the page content not directly under your control can lead to data being lost – is valid.

    Card processors, adverts, analytics – anything somewhere else.

  • Delbert says:

    Got up to an email from BA this morning about my account being compromised and get home this evening to a letter from another company stating that my account had been compromised. LOL.

  • Jimbob says:

    Couple of fraudulent spends, and you get that Amex welcome bonus that little bit quicker!
    Every cloud………

  • Graham Walsh says:

    I had my new Virgin CC on the BA site as I’m hitting those targets. Received this earlier

    Your new card

    Dear Graham

    We’re getting in touch to let you know that we are sending you a new Virgin Atlantic Credit Card.

    You may be aware that British Airways recently reported a data breach. We have identified that you may have used this site and therefore you could have been affected.

    Sending you a new card ahead of your normal card expiry date is an added precaution to protect your account from any potential fraudulent activity. Rest assured your account remains safe and you are not liable for any fraudulent transactions, just let us know if you see anything unusual on your statements.

    If you would like more information from British Airways, you can find it here.

    What do I need to do next?

    Your new Virgin Atlantic Credit Card will arrive in the next 7-10 days, you should:
    Activate your new card in Online Service straightaway.
    Sign your new card as soon as you receive it.
    Destroy your old card.
    As your new card will have a different number, make sure you change any card payments you have set up (e.g. online subscriptions) to the new card number.
    Your existing Credit Card will stop working in 14 days’ time or once you have activated your new one, so please switch over to the new one as soon as you receive it. Your PIN will remain the same.

    If you have already contacted us about this then please be assured your new card will be with you within 7-10 days and you can follow the steps above to start using your new card.

    Yours sincerely

    The Virgin Atlantic Credit Card Team