In a statement, British Airways stated: “ From 22:58 BST August 21 2018 until 21:45 BST September 5 2018 inclusive, the personal and financial details of customers making bookings on ba.com and the airline’s app were compromised .” The airline said they will be notifyingaffected customers, and if anyone has been impacted to contact their bank or credit card providers.
The Telegraph reported 380,0000 payments were compromised, and that BA customers had experienced payment card fraud as a result before the BA breach disclosure, which strongly suggests unencrypted debit\credit cards were stolen.
There are no details about the data theft method at the moment, but given the statement said the BA website and BA mobile app was compromised, I think we could be looking at another example of an insecure API being exploited, as per the Air Canada breach and the T-Mobile breach last month.
We’ll see what comes out in the wash over the next few days and weeks, but thanks to the GDPR, at least UK firms are quickly notifying their customers when their personal and financial data has been compromised, even if there is little detail reported about how. Without knowing how the data was compromised, customers cannot be truly assuredtheir private data is safe. It also will be interesting to learn whether the BA systems were compliant with the Payment Card Industry Data Security Standard (PCI DSS) , required by all organisations that accept, process, store and/or transmit debit and credit cards.
Recent Articles By Author
Cyber Security Roundup for August 2018 Latest on the Currys PC World Data Breach Impacting 10 Million Customers Cyber Security Roundup for July 2018 More from Dave Whitelegg
*** This is a Security Bloggers Network syndicated blog from IT Security Expert Blog authored byDave Whitelegg. Read the original post at: http://feedproxy.google.com/~r/securityexpert/~3/3DkwYFMkL4k/british-airways-customer-data-stolen-in.html