British Airways discloses massive new credit card data breach covering Avios redemption flights

This article is closed to new comments. Feel free to ask your question in the HfP forums.

• James says:

  27 Oct27 October 09:28

  I agree that the headline is incredibly misleading. I was not part of the original group but my data was part of this second wave. It is not until you get to the third paragraph of the email that you see the phrase “it is possible your personal data may have been compromised” loosely thrown in.

  I was particularly annoyed by the start of the paragraph that followed (“We are very sorry that this criminal activity has occurred.”) and by Cruz’s sign-off (“Once again, we truly apologise for any worry and inconvenience this criminal activity has caused”); British Airways’ failure to accept its own part in this mess is insulting. British Airways should instead be sorry that (a) British Airways did not have an adequate IT security policy; (b) British Airways did not have adequate third party vendor review processes; (c) British Airways did not have adequate systems and procedures in place or sufficient management oversight to detect weaknesses in its security sooner; and (d) British Airways’ leadership has not sufficiently emphasized the importance of data security to create a culture which values customers and their data such that the risks were better mitigated.

  That the latest news, which highlights the impact of his leadership decisions on BA’s most loyal customers (again), should serve to remind the board of Cruz’s complete disregard for the long-term brand value and prospects of the company and should lead them to question – yet again – whether his time is up.

  • Ian M says:

    27 Oct27 October 10:26

    Couldn’t agree more

  • Alan says:

    27 Oct27 October 17:10

    Totally agree.

  • Callum says:

    28 Oct28 October 03:24

    It shouldn’t given, as has been shown time and time and time again, the people incessantly whining about Cruz aren’t particularly representative of BAs customer base.

    People have been whining about the damage caused to BA by X, Y and Z for years and years on this site, yet year by year, passenger numbers increase and profit increases.

    • James says:

      28 Oct28 October 07:45

      I might not be representative of their customer base across the board, but I do fly in CW or F from London to New York at least twice a month, which means that I (and I suspect many other readers of this website who incessantly whine) contribute disproportionately to the profitable part of their operations. I have put up with BA’s lack of investment in its seats and service for a long time because I am so invested in BAEC, but with each problem my loyalty is slowly eroded. Last quarter I started taking every other flight with Delta/Virgin and suspect I will gradually shift my loyalty entirely. What you fail to realize is that BA’s most (and possibly only) profitable customers notice each and every one of the “X, Y and Z” issues and while each one may not be enough to cause them to move allegiance, cumulatively the damage could be catastrophic. Cruz’s mistaken focus means that short term profit growth to placate short term investors could result in the long term dissolution of BA’s profitable loyal customers. Loyalty is hard-won and easily lost.

      • Callum says:

        28 Oct28 October 12:50

        I don’t care what your travel patterns are, your attitude is what isn’t representative. Every single time someone like you pops up to say “this might not make a difference but it will add up and that will eventually” yet that time never comes.

        You also don’t have the slightest idea what Cruz does, so I have no idea why you feel you are more informed about his performance than his bosses are. How arrogant can you get!

• Swiss SKI says:

  27 Oct27 October 22:00

  OT: I got a 25GBP off code for Swiss at the London Ski Festival: swissukski25

  UK to GVA/ZRH
  Book by 31/1/19
  Travel by 31/3/19

  Tested and working, random LHR-GVA return with luggage in Feb was GBP74 with voucher

• Callum says:

  28 Oct28 October 03:31

  We live in a highly computerised world. Data breaches are a part of normal life (https://en.wikipedia.org/wiki/List_of_data_breaches) and will continue indefinitely across all industries. Rant about how poor company X’s security is (despite presumably actually knowing nothing whatsoever about it) all you want, it’s impossible to have impenetrable security. I know someone who infiltrated CIA systems while they were a teenager – absolutely nothing in this area is perfect. Which doesn’t mean I’m saying BA did enough to keep it secure, it means you couldn’t possibly know that.

  If this is a major problem for you I suggest you withdraw from this and go back to hard cash. Not convenient? That’s the price you pay.

  • James says:

    28 Oct28 October 07:27

    Callum,

    As it is an ongoing criminal investigation I do not know with any certainty what methods the attackers used or the specific weaknesses in BA’s systems, but as part of my job I am well versed in some of the measures that well-managed businesses take to mitigate the risks of attacks. Analysts at RiskIQ and elsewhere suspect that the British Airways hackers likely used a “cross-site scripting” attack, in which bad actors identify a poorly secured web page component and inject their own code into it to alter a victim site’s behavior. The attack doesn’t necessarily involve penetrating an organization’s network or servers, which would explain how hackers only accessed information submitted during a very specific timeframe, and compromised data that British Airways itself doesn’t store. If true, this was not a sophisticated attack – it relies on a poorly secured web page that British Airways could have prevented with adequate procedures. Cross-site scripting attacks are not new and some of the biggest web giants have been attacked in this way (Including Twitter, Facebook and YouTube), it is the failure of BA to learn from these and appreciate its responsibility for the systems it operates that is worrying. Regular penetration testing should have picked up this vulnerability.

    As airlines are trusted with huge amounts of personal data, including payment card details,, national identity document details, visa details, travel plans etc, they owe a duty of care to customers in the handling of that data and should be held to a high standard of account. Asi Sinclair Barnes, strategic marketing director, airline, at Amadeus “I think it’s the duty of any organization who manages data to make sure that they have the highest level of security compliance and that they are supporting each other. It comes down to accountability of every single company.”

    I completely agree that cyber attacks are going to be an increasingly common feature of our lives but rather than go back to hard cash there should be a flight to well-managed businesses that invest in technology and whose leaders prioritize information security. Time and time again British Airways’ technology has been shown wanting; that is not a good sign for a business that relies so heavily on IT for it’s safe operation.

This article is closed to new comments. Feel free to ask your question in the HfP forums.