Maximise your Avios, air miles and hotel points

British Airways discloses massive new credit card data breach covering Avios redemption flights

Links on Head for Points may support the site by paying a commission.  See here for all partner links.

The British Airways data breach saga, which first emerged in early September, has taken another painful turn for the airline.

British Airways disclosed on Thursday afternoon that a further 185,000 payment cards had potentially been compromised.

These cards had all been used to pay for Avios redemptions between 21st April and 28th July.

Only online bookings at ba.com were impacted.  Redemptions made via the British Airways app or call centre are safe.

Note that ALL forms of Avios redemption appear to be impacted.  You are included if you used Avios to part-pay for a car rental or hotel booking, according to BA.

It is important to note that this is 185,000 ADDITIONAL payment cards which are affected.  British Airways seems to have massaged the headline figure by stripping out cards which were also caught up in the first data breach.

The full statement is here.

The latest disclosure is broken down as follows:

77,000 payment cards have had their name, billing address, email address, payment number, expiry and CVV potentially compromised

108,000 payment cards have been similarly compromised but without the CVV number

You will receive an email during Friday if you are impacted.  According to BA:

“While we do not have conclusive evidence that the data was removed from British Airways’ systems, we are taking a prudent approach in notifying potentially affected customers, advising them to contact their bank or card provider as a precaution.”

On the upside, further investigation by British Airways into the original data breach last month has found that ‘only’ 244,000 payment cards have been compromised compared with the 380,000 figure originally claimed.

And, of course, Cathay Pacific revealed on Thursday that a whopping 9.4m sets of personal records had been unlawfully accessed.  This includes credit card data.

In some ways, this breach could be worse for BA than the original.  185,000 people represents a high percentage of the active British Airways Executive Club base.  The original breach will have caught up a lot of ‘once a year’ flyers whilst this one will be impacting people like us who make up a disproportionate part of BA revenue.  Anyone who has already sat through the 2017 weekend IT failure and the recent failures of the new FLY check-in system will probably have had enough by now.

You can find the latest BA statement on this latest breach here.

PS.  Having now seen the British Airways email, the heading “Update on Theft of Customer Data” is hugely misleading in my opinion and may lead to the email being deleted unread.


How to earn Avios from UK credit cards

How to earn Avios from UK credit cards (April 2024)

As a reminder, there are various ways of earning Avios points from UK credit cards.  Many cards also have generous sign-up bonuses!

In February 2022, Barclaycard launched two exciting new Barclaycard Avios Mastercard cards with a bonus of up to 25,000 Avios. You can apply here.

You qualify for the bonus on these cards even if you have a British Airways American Express card:

Barclaycard Avios Plus card

Barclaycard Avios Plus Mastercard

Get 25,000 Avios for signing up and an upgrade voucher at £10,000 Read our full review

Barclaycard Avios card

Barclaycard Avios Mastercard

5,000 Avios for signing up and an upgrade voucher at £20,000 Read our full review

There are two official British Airways American Express cards with attractive sign-up bonuses:

British Airways American Express Premium Plus

25,000 Avios and the famous annual 2-4-1 voucher Read our full review

British Airways American Express

5,000 Avios for signing up and an Economy 2-4-1 voucher for spending £15,000 Read our full review

You can also get generous sign-up bonuses by applying for American Express cards which earn Membership Rewards points. These points convert at 1:1 into Avios.

American Express Preferred Rewards Gold

Your best beginner’s card – 20,000 points, FREE for a year & four airport lounge passes Read our full review

The Platinum Card from American Express

40,000 bonus points and a huge range of valuable benefits – for a fee Read our full review

Run your own business?

We recommend Capital on Tap for limited companies. You earn 1 Avios per £1 which is impressive for a Visa card, along with a sign-up bonus worth 10,500 Avios.

Capital on Tap Business Rewards Visa

Huge 30,000 points bonus until 12th May 2024 Read our full review

You should also consider the British Airways Accelerating Business credit card. This is open to sole traders as well as limited companies and has a 30,000 Avios sign-up bonus.

British Airways Accelerating Business American Express

30,000 Avios sign-up bonus – plus annual bonuses of up to 30,000 Avios Read our full review

There are also generous bonuses on the two American Express Business cards, with the points converting at 1:1 into Avios. These cards are open to sole traders as well as limited companies.

American Express Business Platinum

40,000 points sign-up bonus and an annual £200 Amex Travel credit Read our full review

American Express Business Gold

20,000 points sign-up bonus and FREE for a year Read our full review

Click here to read our detailed summary of all UK credit cards which earn Avios. This includes both personal and small business cards.

Comments (251)

This article is closed to new comments. Feel free to ask your question in the HfP forums.

  • Harry says:

    I used my BA card in the time frame but have not yet received an email from BA. I did get one from AMEX telling me if you are potentially affected, BA will be in touch if you really are.

    This sort of very sloppy IT management by BA is extremely annoying and time wasting but no customer will actually lose money or AVIOS.

    I have not “had enough” as I use BA to fly with when they are the best all-around option for getting where I want to go. I do not let anyone store my credit card details. I put everything in each time I book a flight or buy over the internet. Takes a few more seconds but is safer.

    As to what Callum says about using Revolut, whose card I also have to get cash out abroad, that is great except that you get no points anywhere!

    • RussellH says:

      AIUI, the risk of you having your card details stolen by means of a man-in-the-middle attack or similar, while entering them manually, is supposed to be greater than the risk of the details being stolen in this sort of data breach.
      I have not seen any research, though.

  • BJ says:

    When BA ultimately gets fined for this under the new EU rules who/where does the money go to?

    • Alex W says:

      It gets shared equally between Boris, Gove and Farage.

      • Bonglim says:

        I wonder if a downing street petition to have the fine equally shared between all those that have been affected would have some traction.

  • Luthar says:

    I received the email in the early hours of this morning. They say that all of my data may have been accessed and to contact my bank to discuss what to do. Well I used an Amex and I check my account twice a day, I’ve noticed nothing untoward.

  • Lou says:

    Oh great, so it turns out I made a pay with points booking during that period. That would explain why I got an email from Amex telling me they’re looking after stuff. Good to see I hear about a potential issue from my credit card provider first, and not the party who actually screwed up.

    • Stuart says:

      The same for me – I received an email from American Express before BA and didn’t understand why Amex had sent the email when i read it.

      • Anthony says:

        +1. I deleted the Amex one as I thought it was generic. Also totally agree with Rob – I was just about to delete the BA one when I realised it was actually breaking something crucial. So thanks BA : my card details are now part all this nonsense.

        • Tom W says:

          Not sure this is accurate – I had the same email but have never even booked a flight with BA

  • Ouaile says:

    Ive got an email from BA this morning.. they are offering 12month or protect my id from Experian

    • shd says:

      Hell would freeze over before I’d willingly share any more information of my personal information with Experian

      • Genghis says:

        Is that information that they already hold?

        • shd says:

          I’ve no idea what Experian think they know about me, but I’m sure I know stuff about me that they don’t.

          Get a “free credit report”, all you have to do is hand over loads of your personal information? As the saying goes, “If You’re Not Paying for It; You’re the Product”

      • Daniel says:

        Well it’s better than Equifax at least, who have had a breach themselves.

  • Callum Graham says:

    I have been affected by both data breaches and the communication from BA has very much attempted to downplay the importance of each. Time to join the class action I think.

    • Shoestring says:

      So have you suffered a material loss?

      • David says:

        Do you need to under GDPR rules?

        • Andrew says:

          No. But equally any fine isn’t going to end up in your bank account.

          I’m sure BA will be fined generously as a result of these breaches. Just wait for the natural course of events to unfold

      • BJ says:

        Even if he has not lost any cash he has lost data, time, confidence …

        Btw, the cat pic wouldn’t load and you will find some deals at asda including Maleficent and Voldemort if you yourself want to be suitably attired for the coming days, if it’s good enough for Miles….

    • Leo says:

      We don’t have class actions in the UK

  • Cheshire Pete says:

    Having avoided the 1st breach by 3 hours, got the email yesterday from BA. Same day I also got the Cathay email! At least both offerd 12 months of Experian!

  • Paul says:

    As s GCH I cant tell you just how much I dislike BA. This incident topped off a horrible summer of dealing with them and their general incompetence and arrogance. As ide from losing my data they took over £900 off me ( now refunded) as no one can read a fare rule rule. Cruz’s Office could not have cared less.
    I rerouted a 241 booking yesterday and beside their rip off fees per passenger I paid full fees on an RFD route as the first sector is not RFS.
    I have now booked for 2019 and BA, indeed, oneworld do not figure in my plans and so status lost for 4 people. Frankly it will save my blood pressure and I just hope that the ICO throws the book at them

This article is closed to new comments. Feel free to ask your question in the HfP forums.

The UK's biggest frequent flyer website uses cookies, which you can block via your browser settings. Continuing implies your consent to this policy. Our privacy policy is here.