BA reveals thousands more customers affected by cyber attack
British Airways’ parent IAG has revealed that a further 185,000 customers might have been affected by a cyber attack on the airline earlier this year.
As a result of investigations into the hacking incident, the airline said it was contacting two groups of customers not previously notified that their personal data might have been leaked.
It said the names, billing addresses, email address and payment card information including the card number, expiry date and CVV code of 77,000 customers have potentially been compromised.
A further 108,000 people’s personal details without CVV (the three numbers on the back of the card) have also been compromised.
Those who made reward bookings between April 21 and July 28 this year and who used a payment card are the ones affected.
In September, thousands of BA customers were forced to cancel their credit cards after the airline admitted that a 15-day data hack had compromised 380,000 payments.
The cyber attack led to a criminal inquiry by specialist cyber officers from the National Crime Agency.
The firm said today that of the 380,000 payment card details identified, 244,000 were affected.
"While British Airways does not have conclusive evidence that the data was removed from its systems, it is taking a prudent approach in notifying potentially affected customers, advising them to contact their bank or card provider as a precaution," IAG said.
The airline said there had been no verified cases of fraud since its announcement on September 6.
BA made the announcement that more people than originally thought had been affected by the cyber attack to the London Stock Market on the day that another airline, Cathay Pacifc, admitted it had also suffered a data breach.
BA is facing up to a £500 million fine as a result of the data breach as the hackers obtained enough information to use the credit cards. The Information Commissioner’s Office is also investigating the incident.
BA’s data breach took place after the introduction of the new Data Protection Act, under which the maximum fine for a company hit with a date breach if £17 million or 4% of global turnover, whichever is greater.
In 2017, BA’s total revenue was £12.2 billion.
Linsey McNeill
Editor Linsey McNeill has been writing about travel for more than three decades. Bylines include The Times, Telegraph, Observer, Guardian and Which? plus the South China Morning Post. She also shares insider tips on thetraveljournalist.co.uk
Vegas’s Billion-Dollar Secrets – What They Don’t Want Tourists to Know
Visit Florida’s New CEO Bryan Griffin Shares His Vision for State Tourism with Graham
Chicago’s Tourism Renaissance: Graham Interviews Kristin Reynolds of Choose Chicago
Graham Talks with Cassandra McCauley of MMGY NextFactor About the Latest Industry Research
Destination International’s Andreas Weissenborn: Research, Advocacy, and Destination Impact
Graham and Don Welsh Discuss the Success of Destinations International’s Annual Conference
Graham and CEO Andre Kiwitz on Ventura Travel’s UK Move and Recruitment for the Role
Brett Laiken and Graham Discuss Florida’s Tourism Momentum and Global Appeal
Graham and Elliot Ferguson on Positioning DC as a Cultural and Inclusive Global Destination
Graham Talks to Fraser Last About His England-to-Ireland Trek for Mental Health Awareness
Kathy Nelson Tells Graham About the Honour of Hosting the World Cup and Kansas City’s Future
Graham McKenzie on Sir Richie Richardson’s Dual Passion for Golf and His Homeland, Antigua
ADS PRO 
Germany new European Entry/Exit System limited to a single airport on October 12, 2025
Airlines suspend Madagascar services following unrest and army revolt
Qatar Airways offers flexible payment options for European travellers
TAP Air Portugal to operate 29 flights due to strike on December 11
Air Mauritius reduces frequencies to Europe and Asia for the holiday season