Friday was one of those occasional crazy days for us. Whenever British Airways is leading the news agenda we are normally sucked along in the tailwind, whether we like it or not. Thanks to everyone who shared their experiences and suggestions via our comments.
I popped up in the Daily Telegraph (see here), The Guardian and Daily Express and I did a segment for talkRADIO (listen here in the 14.30 segment, 5:11 in). I was even invited on Good Morning Britain but unfortunately (or not) the invite arrived after I had gone to bed on Thursday. I wore my best TV shirt to the office just in case but no other offers were forthcoming 🙂
What did we actually learn though?
The key revelation yesterday was the sheer breadth of data that was stolen.
We know that 380,000 bookings were compromised. These were made between 22:58 on 21st August and 21:45 on 5th September. For all of those bookings, the hackers have your:
- email address
- postal address
- credit card number
- expiration date
…. according to Alex Cruz on Radio 4. The CVV data gives a clue to how this happened. Companies are not allowed to store CVV numbers. This means that the data was stolen on the journey from the BA IT system to BA’s payment processing company.
Who was impacted?
It still isn’t clear. British Airways has said that only bookers at ba.com and via the mobile app were affected.
However, various reports in our comments and elsewhere suggest that people who have booked via telephone and with BA Holidays are receiving emails saying their details are compromised. People who have only had money REFUNDED are also reporting getting the email. It is probably best to assume that any transaction you’ve made which led to a BA credit card charge or refund is likely to be at risk.
Am I at risk if I didn’t make a booking?
No. Any stored cards you have at ba.com were not compromised.
No passport or flight data was stolen either, as this is not passed to the payment processing company.
Whilst ba.com now says “The personal and financial details of customers making or changing bookings on ba.com and the airline’s mobile app were compromised.”, my reading of this is that you only have issues if you made a change which incurred a change fee. Paying the change fee will have exposed your card details.
Will BA be fined for this?
Almost certainly, under the new GDPR regime which came into force this year. It is likely to be the first major penalty enforced since those rules were adopted. It will be interesting to see what level it is set at, given that the cap is 4% of BA’s (huge) turnover.
IAG’s share price fell 3.6% yesterday morning as investors worries about compensation payments and the impact on future bookings but had recovered to a 1.35% fall by the end of the day. The overall market was only down 0.55%.
Talking of the new regulations …..
This, from the ICO website, is what the Information Commissioners Office says a company has to tell its customers when it discovers a breach. British Airways did not comply with this in its original email to those who were impacted, which is why it had to send a 2nd email last night. These are the rules:
“You need to describe, in clear and plain language, the nature of the personal data breach and, at least:
- the name and contact details of your data protection officer (if your organisation has one) or other contact point where more information can be obtained;
- a description of the likely consequences of the personal data breach; and
- a description of the measures taken, or proposed to be taken, to deal with the personal data breach and including, where appropriate, of the measures taken to mitigate any possible adverse effects.”
Should I pro-actively cancel my credit card?
There is no evidence yet of any card fraud linked to this breach.
This in itself is odd. Why go to all the trouble of stealing this data if you are not going to cash in on it?
American Express has decided to do nothing. If you want full peace of mind, I recommend reporting your card as ‘lost’ via the website which will trigger a new one. Monzo, Starling, Virgin Money and Tesco Bank, amongst others have said that any card which was used for a BA transaction will automatically be replaced.
On the upside ….
There is no sign of Alex’s hi-viz vest yet.
If you want to know more …..
There is a dedicated British Airways web page with more information which you can find here.
(Want to earn more Avios? Click here to visit our home page for the latest articles on earning and spending your Avios points and click here to see how to earn more Avios from current offers and promotions.)