“A very sophisticated, malicious attack”: that is how BA’s boss, Alex Cruz, described a security breach that allowed cyber criminals to steal personal and financial information from 380,000 customers who booked direct with the airline over a two-week spell. Once again, a failure in British Airways’ IT system has caused massive problems for customers. These are the key questions and answers. Q What happened? Between 10.58pm on 21 August and 9.45pm on 5 September 2018, hackers stole the personal and financial details of people who booked flights on the ba.com website and the British Airways app. Recommended British Airways customers urged to contact banks after website theft The data breach was identified, according to BA, when “a third party noticed some unusual activity and informed us about it”. The airline informed the police and the Information Commissioner. British Airways will not say who the third party was. But The Independent understands it was a company, possibly another airline, that was targeted with a high volume of attempted fraudulent transactions. It is not clear, though, how this was traced back to BA. The airline says that once the theft was identified, ”We immediately acted to close down the issue, and started an investigation as a matter of urgency”. Q Who does this affect? An estimated 380,000 people who booked direct with the airline during the 15-day spell when security was breached. Bookings made outside this timeframe, or through travel agents, are unaffected. Travellers who booked BA “code-share” flights through other airlines’ websites, such as Aer Lingus, American Airlines or Iberia have not had their details stolen. Gadget and tech news: In pictures Show all 25 1 /25 Gadget and tech news: In pictures Gadget and tech news: In pictures Gun-toting humanoid robot sent into space Russia has launched a humanoid robot into space on a rocket bound for the International Space Station (ISS). The robot Fedor will spend 10 days aboard the ISS practising skills such as using tools to fix issues onboard. Russia's deputy prime minister Dmitry Rogozin has previously shared videos of Fedor handling and shooting guns at a firing range with deadly accuracy. Dmitry Rogozin/Twitter Gadget and tech news: In pictures Google turns 21 Google celebrates its 21st birthday on September 27. The The search engine was founded in September 1998 by two PhD students, Larry Page and Sergey Brin, in their dormitories at California’s Stanford University. Page and Brin chose the name google as it recalled the mathematic term 'googol', meaning 10 raised to the power of 100 Google Gadget and tech news: In pictures Hexa drone lifts off Chief engineer of LIFT aircraft Balazs Kerulo demonstrates the company's "Hexa" personal drone craft in Lago Vista, Texas on June 3 2019 Reuters Gadget and tech news: In pictures Project Scarlett to succeed Xbox One Microsoft announced Project Scarlett, the successor to the Xbox One, at E3 2019. The company said that the new console will be 4 times as powerful as the Xbox One and is slated for a release date of Christmas 2020 Getty Gadget and tech news: In pictures First new iPod in four years Apple has announced the new iPod Touch, the first new iPod in four years. The device will have the option of adding more storage, up to 256GB Apple Gadget and tech news: In pictures Folding phone may flop Samsung will cancel orders of its Galaxy Fold phone at the end of May if the phone is not then ready for sale. The $2000 folding phone has been found to break easily with review copies being recalled after backlash PA Gadget and tech news: In pictures Charging mat non-starter Apple has cancelled its AirPower wireless charging mat, which was slated as a way to charge numerous apple products at once AFP/Getty Gadget and tech news: In pictures "Super league" India shoots down satellite India has claimed status as part of a "super league" of nations after shooting down a live satellite in a test of new missile technology EPA Gadget and tech news: In pictures 5G incoming 5G wireless internet is expected to launch in 2019, with the potential to reach speeds of 50mb/s Getty Gadget and tech news: In pictures Uber halts driverless testing after death Uber has halted testing of driverless vehicles after a woman was killed by one of their cars in Tempe, Arizona. March 19 2018 Getty Gadget and tech news: In pictures A humanoid robot gestures during a demo at a stall in the Indian Machine Tools Expo, IMTEX/Tooltech 2017 held in Bangalore Getty Gadget and tech news: In pictures A humanoid robot gestures during a demo at a stall in the Indian Machine Tools Expo, IMTEX/Tooltech 2017 held in Bangalore Getty Gadget and tech news: In pictures Engineers test a four-metre-tall humanoid manned robot dubbed Method-2 in a lab of the Hankook Mirae Technology in Gunpo, south of Seoul, South Korea Jung Yeon-Je/AFP/Getty Gadget and tech news: In pictures Engineers test a four-metre-tall humanoid manned robot dubbed Method-2 in a lab of the Hankook Mirae Technology in Gunpo, south of Seoul, South Korea Jung Yeon-Je/AFP/Getty Gadget and tech news: In pictures The giant human-like robot bears a striking resemblance to the military robots starring in the movie 'Avatar' and is claimed as a world first by its creators from a South Korean robotic company Jung Yeon-Je/AFP/Getty Gadget and tech news: In pictures Engineers test a four-metre-tall humanoid manned robot dubbed Method-2 in a lab of the Hankook Mirae Technology in Gunpo, south of Seoul, South Korea Jung Yeon-Je/AFP/Getty Gadget and tech news: In pictures Waseda University's saxophonist robot WAS-5, developed by professor Atsuo Takanishi Rex Gadget and tech news: In pictures Waseda University's saxophonist robot WAS-5, developed by professor Atsuo Takanishi and Kaptain Rock playing one string light saber guitar perform jam session Rex Gadget and tech news: In pictures A test line of a new energy suspension railway resembling the giant panda is seen in Chengdu, Sichuan Province, China Reuters Gadget and tech news: In pictures A test line of a new energy suspension railway, resembling a giant panda, is seen in Chengdu, Sichuan Province, China Reuters Gadget and tech news: In pictures A concept car by Trumpchi from GAC Group is shown at the International Automobile Exhibition in Guangzhou, China Rex Gadget and tech news: In pictures A Mirai fuel cell vehicle by Toyota is displayed at the International Automobile Exhibition in Guangzhou, China Reuters Gadget and tech news: In pictures A visitor tries a Nissan VR experience at the International Automobile Exhibition in Guangzhou, China Reuters Gadget and tech news: In pictures A man looks at an exhibit entitled 'Mimus' a giant industrial robot which has been reprogrammed to interact with humans during a photocall at the new Design Museum in South Kensington, London Getty Gadget and tech news: In pictures A new Israeli Da-Vinci unmanned aerial vehicle manufactured by Elbit Systems is displayed during the 4th International conference on Home Land Security and Cyber in the Israeli coastal city of Tel Aviv Getty Q What data was stolen, and what could it be used for? When a passenger makes a booking through the British Airways website, they must submit their name, address and credit or debit card details. BA has confirmed that all bank card details were at risk: the number, expiry date and security code or “Card Verification Value” (CVV) on the back. With this information, a fraudster has a range of options, from selling on the data to other criminals to cloning cards or making online purchases. Because of the limited time before the fraud is uncovered, a popular way to extract value from stolen details is to buy plane tickets, typically for high-value, short-notice trips. That is why it is possible that another airline alerted British Airways to the fraud. The airline stresses that “no passport or travel details were stolen”. That should mean that there is no connection between the name and address of the person and their planned dates for being away from home, nor for their passport data to be misused. The nature of the stolen data suggests that it happened during the payment clearing stage of each transaction. The bank wants to check the name, address and card details, rather than the nature of the purchase. Q What details have been stolen – and if my details were stolen, what do I need to do? You should already have been contacted by British Airways and told: “If you believe you have been affected by this incident, then please contact your bank or credit card provider and follow their recommended advice.” The bank may treat your card as physically stolen. The account remains the same, but the compromised card number is changed. That means considerable hassle providing new details to all the firms that automatically bill your credit or debit card. American Express is telling holders of its British Airways-branded cards: “If you have used your American Express card to book with British Airways, we are monitoring your account for you. “We have industry-leading fraud protection technology that is continually monitoring for any suspicious activity in order to safeguard you. Also, our cardmembers are never liable for any fraudulent charges on their accounts.” Q Will I get compensation? If you report the theft of your card details as soon as you become aware, issuers will not charge you for financial transactions. Of course many of the people who bought flights may be away and uncontactable. That appears to rule out claims from customers who incur costs such as loss of earnings from having to “reboot” their financial settings. Q Will my flight booking be affected? No. This appears purely to be a financial crime, and has no effect on the airline’s day-to-day operations. Unlike in June, when thousands of passengers had their BA tickets cancelled and refunded after the airline said its fares system was supplying incorrect data, all bookings made during the affected spell should go ahead as normal. Q What does this mean for British Airways? It is another severe embarrassment related to the airline’s information technology systems. In July around 7,000 passengers had their flights to or from Heathrow cancelled after a failure of an IT system provided to BA by Amadeus. In May 2017, a “power outage” triggered a collapse in the airline’s information systems and the cancellation of hundreds of flights over a bank holiday weekend. As with that event, the costs from this data breach could run into tens of millions of pounds. In addition BA could face a stiff fine from the Information Commissioner. After a cyber attack on TalkTalk in 2015, which affected fewer than half as many customers as BA’s breach, the telecom firm was fined £400,000. The commissioner’s line then was: “Hacking is wrong, but that is not an excuse for companies to abdicate their security obligations.” I bought my BA ticket before the hack, but I flew during it. Is my data likely to be compromised? No, the cyber theft affects only bookings made in the affected timeframe from 21 August to 5 September. Anything else? Beware: the British Airways breach is likely to trigger further attempts at cyber crime, with fraudsters sending out scam emails in a bid to obtain confidential information. BA says: ”British Airways will not be contacting any customers asking for payment card details, any such requests should be reported to the police and relevant authorities.”<doc-sep>Get email updates with the day's biggest stories Invalid Email Something went wrong, please try again later. Sign up Thank you for subscribing We have more newsletters Show me See our privacy notice British Airways has called in police after a massive cyber hack saw the personal and financial details of its customers stolen - with 380,000 bank cards compromised. The airline admitted tonight it is investigating "as a matter of urgency" the theft of customer data from its website and mobile app. BA said it was communicating with customers that had been affected and the chairman said they are "deeply sorry". It advised anyone who believes they may have been affected to contact their banks or credit card providers and follow their advice. They added that they have notified the police and all relevant authorities after they made the discovery last night. Have you been a victim of the BA hack? Email webnews@mirror.co.uk (Image: Getty) The stolen data did not include travel or passport details, the airline said. It added that the breach has been resolved and the website is working normally. In a statement, the airline said: "From 22:58 BST August 21 2018 until 21:45 BST September 5 2018 inclusive, the personal and financial details of customers making bookings on ba.com and the airline's app were compromised." Alex Cruz, British Airways’ Chairman and Chief Executive said: "We are deeply sorry for the disruption that this criminal activity has caused. "We take the protection of our customers’ data very seriously." Concerned customers have been expressing their concern on social media after BA tweeted about the incident. One said: "Not happy BA your security should be tighter." Video Loading Video Unavailable Click to play Tap to play The video will auto-play soon 8 Cancel Play now Others have been asking for more clarifications and information. Mick Walsh wrote: "Several people have asked if this only affects those who made bookings in that time or if it could also affect those with card details saved. "Any chance you could respond?" (Image: Getty) Sebastian Budner tweeted: "This is concerning. Could you clarify if this effects people who made bookings in that period, or anyone who just had card details saved to their account at the time?" Sheila Webster added: "Please clarify what you mean. "Was access available to card details used for bookings made outwth that period? Could they access saved cards? Please clarify urgently. (sic)." BA have been directing people to their website for further information. A spokeswoman from the National Crime Agency said: "We are aware of reports of a data breach affecting British Airways and are working with partners to asses the best course of action."<doc-sep>
British Airways (BA) is investigating "as a matter of urgency" the theft of customer data from its website and has urged customers affected to contact their banks or credit card providers. Between 21 August and 5 September, personal and financial details of around 380,000 payment cards belonging to customers making bookings "were compromised", BA confirmed. The airline added it had notified police after the stolen data, which did not include travel or passport details, was taken from ba.com and its mobile app. British Airways is likely to face many claims from customers who either suffer a financial loss as a result of fraud, or simply incur costs from having to 'reboot' their financial settings. The airline may be handed a stiff fine from the Information Commissioner’s Office. A cyber attack on TalkTalk in 2015 which affected fewer than half as many customers resulted in a record £400,000 fine. The reputational damage could be more serious. The data breach is unconnected with the “power outage” that triggered a collapse of the airline’s information systems in May 2017 and the cancellation of hundreds of flights over a bank holiday weekend. But it will add to an impression that BA has serious IT shortcomings. "The breach has been resolved and our website is working normally," the airline said in a statement. "British Airways is communicating with affected customers and we advise any customers who believe they may have been affected by this incident to contact their banks or credit card providers and follow their recommended advice. A spokesperson told The Independent the breach was identified when "a third party noticed some unusual activity and informed us about it". "We immediately acted to close down the issue, and started an investigation as a matter of urgency." Alex Cruz, BA's chairman and chief executive, said in a statement: "We are deeply sorry for the disruption that this criminal activity has caused. "We take the protection of our customers' data very seriously."