Maximise your Avios, air miles and hotel points

British Airways discloses massive new credit card data breach covering Avios redemption flights

Links on Head for Points may support the site by paying a commission.  See here for all partner links.

The British Airways data breach saga, which first emerged in early September, has taken another painful turn for the airline.

British Airways disclosed on Thursday afternoon that a further 185,000 payment cards had potentially been compromised.

These cards had all been used to pay for Avios redemptions between 21st April and 28th July.

Only online bookings at ba.com were impacted.  Redemptions made via the British Airways app or call centre are safe.

Note that ALL forms of Avios redemption appear to be impacted.  You are included if you used Avios to part-pay for a car rental or hotel booking, according to BA.

It is important to note that this is 185,000 ADDITIONAL payment cards which are affected.  British Airways seems to have massaged the headline figure by stripping out cards which were also caught up in the first data breach.

The full statement is here.

The latest disclosure is broken down as follows:

77,000 payment cards have had their name, billing address, email address, payment number, expiry and CVV potentially compromised

108,000 payment cards have been similarly compromised but without the CVV number

You will receive an email during Friday if you are impacted.  According to BA:

“While we do not have conclusive evidence that the data was removed from British Airways’ systems, we are taking a prudent approach in notifying potentially affected customers, advising them to contact their bank or card provider as a precaution.”

On the upside, further investigation by British Airways into the original data breach last month has found that ‘only’ 244,000 payment cards have been compromised compared with the 380,000 figure originally claimed.

And, of course, Cathay Pacific revealed on Thursday that a whopping 9.4m sets of personal records had been unlawfully accessed.  This includes credit card data.

In some ways, this breach could be worse for BA than the original.  185,000 people represents a high percentage of the active British Airways Executive Club base.  The original breach will have caught up a lot of ‘once a year’ flyers whilst this one will be impacting people like us who make up a disproportionate part of BA revenue.  Anyone who has already sat through the 2017 weekend IT failure and the recent failures of the new FLY check-in system will probably have had enough by now.

You can find the latest BA statement on this latest breach here.

PS.  Having now seen the British Airways email, the heading “Update on Theft of Customer Data” is hugely misleading in my opinion and may lead to the email being deleted unread.


How to earn Avios from UK credit cards

How to earn Avios from UK credit cards (April 2025)

As a reminder, there are various ways of earning Avios points from UK credit cards.  Many cards also have generous sign-up bonuses!

In February 2022, Barclaycard launched two exciting new Barclaycard Avios Mastercard cards with a bonus of up to 25,000 Avios. You can apply here.

You qualify for the bonus on these cards even if you have a British Airways American Express card:

Barclaycard Avios Plus card

Barclaycard Avios Plus Mastercard

Get 25,000 Avios for signing up and an upgrade voucher at £10,000 Read our full review

Barclaycard Avios card

Barclaycard Avios Mastercard

Get 5,000 Avios for signing up and an upgrade voucher at £20,000 Read our full review

There are two official British Airways American Express cards with attractive sign-up bonuses:

British Airways American Express Premium Plus

30,000 Avios and the famous annual 2-4-1 voucher Read our full review

British Airways American Express

5,000 Avios for signing up and an Economy 2-4-1 voucher for spending £15,000 Read our full review

You can also get generous sign-up bonuses by applying for American Express cards which earn Membership Rewards points. These points convert at 1:1 into Avios.

American Express Preferred Rewards Gold

Your best beginner’s card – 30,000 points, FREE for a year & four airport lounge passes Read our full review

The Platinum Card from American Express

80,000 bonus points and great travel benefits – for a large fee Read our full review

Run your own business?

We recommend Capital on Tap for limited companies. You earn 1 Avios per £1 which is impressive for a Visa card, and the standard card is FREE. Capital on Tap cards also have no FX fees.

Capital on Tap Visa

NO annual fee, NO FX fees and points worth 1 Avios per £1 Read our full review

Capital on Tap Pro Visa

10,500 points (=10,500 Avios) plus good benefits Read our full review

There is also a British Airways American Express card for small businesses:

British Airways American Express Accelerating Business

30,000 Avios sign-up bonus – plus annual bonuses of up to 30,000 Avios Read our full review

There are also generous bonuses on the two American Express Business cards, with the points converting at 1:1 into Avios. These cards are open to sole traders as well as limited companies.

American Express Business Platinum

50,000 points when you sign-up and an annual £200 Amex Travel credit Read our full review

American Express Business Gold

20,000 points sign-up bonus and FREE for a year Read our full review

Click here to read our detailed summary of all UK credit cards which earn Avios. This includes both personal and small business cards.

Comments (245)

This article is closed to new comments. Feel free to ask your question in the HfP forums.

  • Simon says:

    That would explain the massive amount of fraud I experienced in May and June, when I booked an Avios redemption almost every week. As soon as Amex issued a new card because of fraudulent charges, the new card would suffer the same fate. Very disappointed with BA.

  • John H says:

    I’ve been caught up in this BA debacle, I was targeted for a small €99 charge on my BA Amex whilst I was away in Cyprus. I have to say thanks to the Amex App I spotted the 4am charge to my account phoned Amex and they sorted it out there and then and had my new card within 24hrs as I arrived home. So shame on BA but well done Amex. Just waiting to be hit again in this round as I have booked more Avios flights.

  • ft_overthehorizon says:

    I was also caught in this second breach, but as I always use Paypal for redemptions, I’m pretty sure I’m in the clear…

    • Bonglim says:

      annoyingly have to use the card directly when doing a 241 redemptions.
      That is what happened to me and I got caught out.
      Amex were great though.

  • Nick G says:

    I agree rob very misleading title. I was equally as confused until I read it was in addition!

    What about using Amex for making bookings on the Iberia 9k giveaway? Haven’t done many redemptions otherwise

  • MsB says:

    Received email from BA last night, having two booked redemptions in May.
    I paid via PayPal. Am I right to assume my credit card details won’t have been compromised?

  • Andy says:

    Well that explains the fraud on my BA Amex card back in August. Luckily the Amex App on my iPhone notified me of a £400 ASOS transaction straight away.
    It did however make me spend a couple of hours on a lovely summers day at a friend’s 50th birthday barbecue stuck inside sorting it all out. And then missing out on Avios from being without my card for a few days and having to use a different card for some big purchases.
    Whether or not this counts as “matrerial loss” I’m guessing not given BA’s customer service. A handful of Avios as compensation would be nice.

    • Rob says:

      No it doesn’t – BA makes it quite clear in its email that there hasn’t been a single case of fraud resulting from the sale of your card details on the dark web, honest guv ….. which makes you wonder how stupid the people who have been handing over $10+ per set of account details actually are ….

      • shd says:

        How can BA *possibly* know there’s been zero fraud due to this latest leak?

        How can they possibly know there won’t be in the future?

        (Spoiler: unless Cruz has found a working crystal ball, they obviously can’t)

      • Andy says:

        How on earth can they know? The timing of my fraud is deeply suspicious in that it happened soon after the dates BA notified me about, and they had all my card details. Hasn’t happened before with any of my Amex cards, I only use the BA card online for flights so I can’t see how else they would have got that info?..

        • Mark says:

          Quite. They can’t, of course. The way this is being handled with smoke and mirrors is almost as shocking as allowing it to happen in the first place.

          Time for Cruz to hand over the reigns to someone who understands that running a successful business requires more than just deep cost cutting.

        • Shoestring says:

          reins, as in what you might control a horse with

        • Mark says:

          OMG, the HFP’s been hacked by a spurious g adder.. 🙂

        • Shoestring says:

          No problemo with the old vernacular lol

          But certain things drive me mad as they hint the person hasn’t actually understood the underlying logic. My brother will very happily repeat ‘to be pacific’ ad nauseam (esp when he’s into the beers) even though he’s been told many times about ‘specific’ lol

      • Andy says:

        “Of the 380,000 payment card details announced, 244,000 were affected. Crucially, we have had no verified cases of fraud.”

        Well I’ve notified BA today by email of the fraud on my account from the details being stolen so count that as one verified case 🙂

        • Shoestring says:

          But you can’t logically/ conclusively link your stolen details with BA’s data breach.

        • JJ says:

          I can conclusively link my card (a new card issued by virgin which the only place it had ever been used was in BA.com) had multiple fraudulent charges made on it, this could only have come from the 1st BA breach.

          I’ve also been caught up in this latest one with a different card.

  • @alastairtravel says:

    Be interested to understand how some CVV numbers were exposed but not others.

    The email I got from BA explicitly said my CVV wasn’t

    • Daniel says:

      Mine does say CVV –> “While we do not have conclusive evidence that the data was removed from British Airways’ systems, it is possible your personal data may have been compromised. This includes your full name, billing address, email address and payment card number, expiry date and CVV. As a precaution we recommend you contact your bank or card provider and follow their advice.”

      • @alastairtravel says:

        Mine is different:

        While we do not have conclusive evidence that the data was removed from British Airways’ systems, it is possible your personal data may have been compromised. This includes your full name, billing address, email address and payment card details. Your CVV number has remained confidential

        • Michael Jennings says:

          I got that, too. I did book an Avios redemption in that period, but I *think* I did it using the BA App rather than the website.

      • Lady London says:

        I love British Airways saying this data was ‘removed’. To me that shouted ‘weasel word’. Data doesn’t get removed in a hack. The data isn’t removed. It’ss copied. Its still there in the care of British Airways – otherwise how else could they issue your ticket – but someone has been able to copy it.

        Saying ‘removed’ instead of the apparent truth ‘we allowed someone to copy it’ just shifts the blame onto the person that ‘removed’ it not the company that failed to protect it!

        For their weaselling communication alone I really hope BA get caned by the regulator on this. Is it a criminal charge they will be facing? If so then if they are convicted then as the burden of proof is higher in criminal cases then a conviction would open the door to civil compensation claims with lower burden of proof.

    • Lady London says:

      That sounds as though British Airways held data was hacked by two different successful methods. Wow.

  • Steve R says:

    Under GDPR, Data Protection Act 1998 & 2018 you are allowed to claim compensation for distress alone

This article is closed to new comments. Feel free to ask your question in the HfP forums.

The UK's biggest frequent flyer website uses cookies, which you can block via your browser settings. Continuing implies your consent to this policy. Our privacy policy is here.