British Airways reveals massive data breach, could face £500m fine under GDPR

Source: Vsoftsystems, 10/09/2018

It has now recruited the help of the National Crime Agency and
National Cyber Security Centre to investigate into how the incident
was able to happen.
BA has confirmed that only bookings made between 22:58 BST 21 August
and 21:45 5 September are thought to have been affected, however,
those customers involved are likely to have had their personal and
financial details compromised as a result.
BA said details including personal information and payment data may
have been stolen from those using the company`s website and mobile app
to make bookings. However, passport details and travel plans were not
accessed by the hackers, the airline said, and stressed that only
people who had bookings during the two-week period in question were at
risk.
BA revealed that 380,000 customer transactions were compromised and
those involved had been advised by the company on Thursday night that
their information may be at risk.
`The breach has been resolved and our website is working normally,` BA
said in a statement. `We have notified the police and relevant
authorities. We are deeply sorry for the disruption that this criminal
activity has caused. We take the protection of our customers` data
very seriously.`
BA said it began notifying affected customers at 22:00 on Thursday
evening but that this process had been delayed due to the high volume
of emails being sent.
Anyone who thinks they may have been a subject of fraud as a result of
the attack should contact their bank or credit card provider as a
matter of urgency to prevent any further malicious activity occurring,
BA said in the statement. Those contacted by BA should change their
online passwords immediately and monitor the account or statements of
the card used to make their travel purchase.
“We are deeply sorry for the disruption that this criminal activity
has caused. We take the protection of our customers’ data very
seriously,” Alex Cruz, British Airways’ chairman and chief executive said.
The incident marks one of the first major data breaches to occur since
the enactment of the GDPR, raising the possibility that BA could be
one of the first companies to be hit by the new, higher penalties. If
the company is hit with the maximum fine, 4% of global turnover, it`s
likely to be as high as £500 million, based on BA`s 2017 revenue reports.
`We are aware of an incident involving British Airways and are making
enquiries,` a spokesperson for the Information Commissioner`s Office said.
Chris Boyd, lead malware analyst at Malwarebytes, told IT Pro that
it`s fortunate BA has been able to give a specific time and date range
for the data breach.
`Typically, we`re lucky to get a date range of less than six months to
a year, which makes a potential victim`s response to any threat
difficult,` said Boyd. `This could end up being a major test of new
GDPR regulations, and it`ll be fascinating to see the cause of the
breach come out in the wash.`