Maximise your Avios, air miles and hotel points

British Airways discloses massive new credit card data breach covering Avios redemption flights

Links on Head for Points may support the site by paying a commission.  See here for all partner links.

The British Airways data breach saga, which first emerged in early September, has taken another painful turn for the airline.

British Airways disclosed on Thursday afternoon that a further 185,000 payment cards had potentially been compromised.

These cards had all been used to pay for Avios redemptions between 21st April and 28th July.

Only online bookings at ba.com were impacted.  Redemptions made via the British Airways app or call centre are safe.

Note that ALL forms of Avios redemption appear to be impacted.  You are included if you used Avios to part-pay for a car rental or hotel booking, according to BA.

It is important to note that this is 185,000 ADDITIONAL payment cards which are affected.  British Airways seems to have massaged the headline figure by stripping out cards which were also caught up in the first data breach.

The full statement is here.

The latest disclosure is broken down as follows:

77,000 payment cards have had their name, billing address, email address, payment number, expiry and CVV potentially compromised

108,000 payment cards have been similarly compromised but without the CVV number

You will receive an email during Friday if you are impacted.  According to BA:

“While we do not have conclusive evidence that the data was removed from British Airways’ systems, we are taking a prudent approach in notifying potentially affected customers, advising them to contact their bank or card provider as a precaution.”

On the upside, further investigation by British Airways into the original data breach last month has found that ‘only’ 244,000 payment cards have been compromised compared with the 380,000 figure originally claimed.

And, of course, Cathay Pacific revealed on Thursday that a whopping 9.4m sets of personal records had been unlawfully accessed.  This includes credit card data.

In some ways, this breach could be worse for BA than the original.  185,000 people represents a high percentage of the active British Airways Executive Club base.  The original breach will have caught up a lot of ‘once a year’ flyers whilst this one will be impacting people like us who make up a disproportionate part of BA revenue.  Anyone who has already sat through the 2017 weekend IT failure and the recent failures of the new FLY check-in system will probably have had enough by now.

You can find the latest BA statement on this latest breach here.

PS.  Having now seen the British Airways email, the heading “Update on Theft of Customer Data” is hugely misleading in my opinion and may lead to the email being deleted unread.


How to earn Avios from UK credit cards

How to earn Avios from UK credit cards (April 2025)

As a reminder, there are various ways of earning Avios points from UK credit cards.  Many cards also have generous sign-up bonuses!

In February 2022, Barclaycard launched two exciting new Barclaycard Avios Mastercard cards with a bonus of up to 25,000 Avios. You can apply here.

You qualify for the bonus on these cards even if you have a British Airways American Express card:

Barclaycard Avios Plus card

Barclaycard Avios Plus Mastercard

Get 25,000 Avios for signing up and an upgrade voucher at £10,000 Read our full review

Barclaycard Avios card

Barclaycard Avios Mastercard

Get 5,000 Avios for signing up and an upgrade voucher at £20,000 Read our full review

There are two official British Airways American Express cards with attractive sign-up bonuses:

British Airways American Express Premium Plus

30,000 Avios and the famous annual 2-4-1 voucher Read our full review

British Airways American Express

5,000 Avios for signing up and an Economy 2-4-1 voucher for spending £15,000 Read our full review

You can also get generous sign-up bonuses by applying for American Express cards which earn Membership Rewards points. These points convert at 1:1 into Avios.

American Express Preferred Rewards Gold

Your best beginner’s card – 30,000 points, FREE for a year & four airport lounge passes Read our full review

The Platinum Card from American Express

80,000 bonus points and great travel benefits – for a large fee Read our full review

Run your own business?

We recommend Capital on Tap for limited companies. You earn 1 Avios per £1 which is impressive for a Visa card, and the standard card is FREE. Capital on Tap cards also have no FX fees.

Capital on Tap Visa

NO annual fee, NO FX fees and points worth 1 Avios per £1 Read our full review

Capital on Tap Pro Visa

10,500 points (=10,500 Avios) plus good benefits Read our full review

There is also a British Airways American Express card for small businesses:

British Airways American Express Accelerating Business

30,000 Avios sign-up bonus – plus annual bonuses of up to 30,000 Avios Read our full review

There are also generous bonuses on the two American Express Business cards, with the points converting at 1:1 into Avios. These cards are open to sole traders as well as limited companies.

American Express Business Platinum

50,000 points when you sign-up and an annual £200 Amex Travel credit Read our full review

American Express Business Gold

20,000 points sign-up bonus and FREE for a year Read our full review

Click here to read our detailed summary of all UK credit cards which earn Avios. This includes both personal and small business cards.

Comments (245)

This article is closed to new comments. Feel free to ask your question in the HfP forums.

  • WhenWillBaCollapse says:

    Just checked some purchases made during the period…happened during a churn cycle so all amexs are cancelled 🙂

    Guess this further supports the case for card churning!

    • Shoestring says:

      5000 HFP cardholders affected by latest BA data breach.

      No cards actually lost any money as all cancelled 2 months previously 🙂

  • BJ says:

    Got lucky last time, almost certainly not this time.

    • Lee says:

      +1

    • MD says:

      Got done (and done hard) last time (might regale you with the tale of woe tomorrow morning in the inevitable furore in the comments section, as I need some advice). Also got the email from Amex this afternoon, but as far as I remember it would be the same BAPP as the last breach, so that’s er, a win I guess? ????

  • Neil Donoghue says:

    It all makes sense why American Expeess is currently offering 500 Avios for a £5 spend….Just BA compensating Amex for yet more headache.

    • BJ says:

      On the plus side, I wonder if this will make IAG devaluations in the near future less likely? Hopefully they will prefer to limit bad press as much as they can.

      • MD says:

        One might hope so, but judging by their attitude to and handling of the last breach, they have no sense of shame so I doubt it would stop them.

    • Tilly says:

      Has anyone successfully trigger the offer? No email to day redeemed like I usually get.

      • Rob says:

        No, it is still showing as ‘Saved’ on my wifes account despite transactions going through and being processed. Odd.

  • Nick says:

    Has anyone affected by the first BA breach signed up to the SPG Law group action lawsuit? It was mentioned by Rob after a piece in The Times, but has also been widely covered since.

    • Oh Matron! says:

      The problem with UK is law is that you have to demonstrate loss. Potential loss isn’t good enough

      • Andrew (@andrewseftel) says:

        That’s been quite a shaky assertion ever since Vidal-Hall v Google

  • James M says:

    I had made a reward booking through BA.com in June – HSBC called me a few weeks ago advising they had stopped my card and were sending a replacement.

    Maybe the banks were advised several weeks ago, perhaps this was just precautionary? Either way well played HSBC.

    Are there any banks / cards that offer ‘one time’ card details i.e. transaction specific, you request a number for a purchase after which it doesn’t work?

    • Shoestring says:

      3V?

    • MD says:

      Revolut do, but only on the Premium version (£6.99/month), not the free one. A virtual cards for online transactions etc that changes number automatically after each use.

      I believe the recently announced (more expensive) metal version has that benefit also.

    • Pol says:

      I have a € bank account with bunq. Their cards don’t have a cvc on the card, the app generates a new cvc every time you pay. You have to open the app to see the code and it expires after 5 minutes, great security feature more banks should consider.
      I made several Avios bookings during the time frame, unfortunately used BA Amex for the extra points though, so may well be affected.

  • David says:

    Does this include “part-pay with Avios” bookings?

    • Rob says:

      Not clear. If part-pay car hire is included then potentially so.

      • David says:

        Hmm, I did a few part-pays but no proper redemptions in that time period, and haven’t received an email from BA yet this time (but I have from Amex).

  • Alan Wan says:

    I have been effected by both BA data breaches this year. No email from Amex yet for the latest. Saying that the card I used for the Avios redemption already cancelled months ago due to my wallet being mislaid. Funnily enough the replacement card (Amex Gold) was cancelled last week due to a fraudulent transaction Amex picked up on.

  • Bonglim says:

    I just received an email from BA saying I was affected.

    The card involved was subject to fraud last month. A couple of hundred pounds spent at deliveroo in Amsterdam. Amex obviously refunded it all immediately.

This article is closed to new comments. Feel free to ask your question in the HfP forums.

The UK's biggest frequent flyer website uses cookies, which you can block via your browser settings. Continuing implies your consent to this policy. Our privacy policy is here.