LONDON – British Airways said the personal and financial details of customers who made bookings between Aug. 21 and Sept. 5 have been stolen in a data breach involving 380,000 bank cards.
The almost two-week-long hack did not involve travel or passport details, the airline said, adding it had launched an urgent investigation into the theft of customer data.
“The personal and financial details of customers making bookings on our website and app were compromised,” it said. “The breach has been resolved and our website is working normally. We have notified the police and relevant authorities.”
BA said the breach took place between 9:58 p.m. GMT on Aug. 21 and 8:45 p.m. GMT on Sept. 5 and that around 380,000 payment cards were compromised.
BA advised anyone who believed they may have been affected to contact their bank or credit card provider and follow their recommendations.
In terms of compensation, BA said it would be in touch with customers “and will manage any claims on an individual basis.”
“We are deeply sorry for the disruption that this criminal activity has caused,” the airline said.
It said customers due to travel could check in online as normal as the incident had been resolved.
BA customer Daniel Willis, 34, who booked a flight on Monday with the airline, said he had not been contacted by the airline despite being affected by the data breach.
“I’ve not heard anything from them on this and I’ve just had to cancel the card I used. They’re a shambles,” he told The Daily Telegraph newspaper.
Another BA customer, Stephanie Jowers, said she contacted the airline hours before the hack was announced to query a suspicious charge on her account but was not informed it could have been compromised.
“I asked repeatedly for an explanation. None was given,” she told the newspaper.
The National Crime Agency said: “We are aware of reports of a data breach affecting British Airways and are working with partners to assess the best course of action.”
The NCA is set up to tackle the most serious and organized crime posing the highest risk to public security in Britain.
BA apologized in July after technology issues caused dozens of its flights to and from Heathrow Airport to be canceled. The airline said the problem was down to an incident with an IT system.
And in May 2017, British Airways suffered a major computer system failure triggered by a power supply issue near Heathrow, which left 75,000 customers stranded.
International Consolidated Airlines Group SA (IAG), which owns British Airways and Spanish carrier Iberia, said last month that first-half profits more than doubled.
Earnings after taxation grew to €1.4 billion ($1.6 billion) in the first six months of 2018 compared with €607 million a year earlier, IAG said in a results statement.
The London-listed group, which is also the owner of Irish airline Aer Lingus and Spanish carrier Vueling, added that total revenues swelled 3 percent to €11.2 billion.
BA announced last month that it will halt flights to Tehran in September, citing low profitability as the U.S. reimposes sanctions on Iran.