Maximise your Avios, air miles and hotel points

What more do we know about the British Airways data breach?

Links on Head for Points may support the site by paying a commission.  See here for all partner links.

Friday was one of those occasional crazy days for us.  Whenever British Airways is leading the news agenda we are normally sucked along in the tailwind, whether we like it or not.  Thanks to everyone who shared their experiences and suggestions via our comments.

I popped up in the Daily Telegraph (see here), The Guardian and Daily Express and I did a segment for talkRADIO.  I was even invited on Good Morning Britain but unfortunately (or not) the invite arrived after I had gone to bed on Thursday.

What did we actually learn though?

The key revelation yesterday was the sheer breadth of data that was stolen.

British Airways BA 777X 777 9X

We know that 380,000 bookings were compromised.  These were made between 22:58 on 21st August and 21:45 on 5th September.  For all of those bookings, the hackers have your:

  • email address
  • postal address
  • credit card number
  • expiration date
  • CVV

…. according to Alex Cruz on Radio 4.  The CVV data gives a clue to how this happened.  Companies are not allowed to store CVV numbers.  This means that the data was stolen on the journey from the BA IT system to BA’s payment processing company.

Who was impacted?

It still isn’t clear.  British Airways has said that only bookers at ba.com and via the mobile app were affected.

However, various reports in our comments and elsewhere suggest that people who have booked via telephone and with BA Holidays are receiving emails saying their details are compromised.  People who have only had money REFUNDED are also reporting getting the email.  It is probably best to assume that any transaction you’ve made which led to a BA credit card charge or refund is likely to be at risk.

Am I at risk if I didn’t make a booking?

No.  Any stored cards you have at ba.com were not compromised.

No passport or flight data was stolen either, as this is not passed to the payment processing company.

Whilst ba.com now says “The personal and financial details of customers making or changing bookings on ba.com and the airline’s mobile app were compromised.”, my reading of this is that you only have issues if you made a change which incurred a change fee.  Paying the change fee will have exposed your card details.

Will BA be fined for this?

Almost certainly, under the new GDPR regime which came into force this year.  It is likely to be the first major penalty enforced since those rules were adopted.  It will be interesting to see what level it is set at, given that the cap is 4% of BA’s (huge) turnover.

IAG’s share price fell 3.6% yesterday morning as investors worries about compensation payments and the impact on future bookings but had recovered to a 1.35% fall by the end of the day.  The overall market was only down 0.55%.

Talking of the new regulations ….

This, from the ICO website, is what the Information Commissioners Office says a company has to tell its customers when it discovers a breach.  British Airways did not comply with this in its original email to those who were impacted, which is why it had to send a 2nd email last night.  These are the rules:

“You need to describe, in clear and plain language, the nature of the personal data breach and, at least:

  • the name and contact details of your data protection officer (if your organisation has one) or other contact point where more information can be obtained;
  • a description of the likely consequences of the personal data breach; and
  • a description of the measures taken, or proposed to be taken, to deal with the personal data breach and including, where appropriate, of the measures taken to mitigate any possible adverse effects.”

Should I pro-actively cancel my credit card?

There is no evidence yet of any card fraud linked to this breach.

This in itself is odd.  Why go to all the trouble of stealing this data if you are not going to cash in on it?

American Express has decided to do nothing.  If you want full peace of mind, I recommend reporting your card as ‘lost’ via the website which will trigger a new one.  Monzo, Starling, Virgin Money and Tesco Bank, amongst others have said that any card which was used for a BA transaction will automatically be replaced.

If you want to know more …..

There is a dedicated British Airways web page with more information which you can find here.

PS. If you are not a regular Head for Points visitor, why not sign up for our FREE weekly or daily newsletters? They are full of the latest Avios, airline, hotel and credit card points news and will help you travel better. To join our 65,000 free subscribers, click the button below or visit this page of the site to find out more. Thank you.

How to earn Avios from UK credit cards

How to earn Avios from UK credit cards (April 2025)

As a reminder, there are various ways of earning Avios points from UK credit cards.  Many cards also have generous sign-up bonuses!

In February 2022, Barclaycard launched two exciting new Barclaycard Avios Mastercard cards with a bonus of up to 25,000 Avios. You can apply here.

You qualify for the bonus on these cards even if you have a British Airways American Express card:

Barclaycard Avios Plus card

Barclaycard Avios Plus Mastercard

Get 25,000 Avios for signing up and an upgrade voucher at £10,000 Read our full review

Barclaycard Avios card

Barclaycard Avios Mastercard

Get 5,000 Avios for signing up and an upgrade voucher at £20,000 Read our full review

There are two official British Airways American Express cards with attractive sign-up bonuses:

British Airways American Express Premium Plus

30,000 Avios and the famous annual 2-4-1 voucher Read our full review

British Airways American Express

5,000 Avios for signing up and an Economy 2-4-1 voucher for spending £15,000 Read our full review

You can also get generous sign-up bonuses by applying for American Express cards which earn Membership Rewards points. These points convert at 1:1 into Avios.

SPECIAL OFFER: Until 27th May 2025, the sign-up bonus on the ‘free for a year’ American Express Preferred Rewards Gold card is increased from 20,000 Membership Rewards points to 30,000 points. Points convert 1:1 into Avios (30,000 Avios!) and many other programmes. Some people may see even higher personalised offers. Click here to apply.

SPECIAL OFFER: Until 27th May 2025, the sign-up bonus on American Express Platinum is increased from 50,000 Membership Rewards points to a huge 80,000 points. Points convert 1:1 into Avios (80,000 Avios!) and many other programmes. Some people may see even higher personalised offers. Click here to apply.

American Express Preferred Rewards Gold

Your best beginner’s card – 30,000 points, FREE for a year & four airport lounge passes Read our full review

The Platinum Card from American Express

80,000 bonus points and great travel benefits – for a large fee Read our full review

Run your own business?

We recommend Capital on Tap for limited companies. You earn 1 Avios per £1 which is impressive for a Visa card, and the standard card is FREE. Capital on Tap cards also have no FX fees.

Capital on Tap Visa

NO annual fee, NO FX fees and points worth 1 Avios per £1 Read our full review

Capital on Tap Pro Visa

10,500 points (=10,500 Avios) plus good benefits Read our full review

There is also a British Airways American Express card for small businesses:

British Airways American Express Accelerating Business

30,000 Avios sign-up bonus – plus annual bonuses of up to 30,000 Avios Read our full review

There are also generous bonuses on the two American Express Business cards, with the points converting at 1:1 into Avios. These cards are open to sole traders as well as limited companies.

American Express Business Platinum

50,000 points when you sign-up and an annual £200 Amex Travel credit Read our full review

American Express Business Gold

20,000 points sign-up bonus and FREE for a year Read our full review

Click here to read our detailed summary of all UK credit cards which earn Avios. This includes both personal and small business cards.

Category

British Airways and Avios

Comments (103)

This article is closed to new comments. Feel free to ask your question in the HfP forums.

  • David says:
    8 Sep8 September 08:15

    Given the fact that I would expect data being transmitted to banks would be encrypted I am utterly at a loss to understand how this could have happened. BA must know if this is an inside job.

    If this relates only to cards processed and not cards stored then it has to be either an inside job at either BA or a card processor, a Trojan that has infiltrated BA’s systems – or incompetence by not encrypting sensitive data.

    Is there more info around on exactly how this occurred and what will stop it occurring in future?

    I know from personal experience of trying to get compensation from BA for flight delays that they cannot be trusted and this is further proof. It is a shame that penalties don’t get given to those affected but presumably go into some government pot Maybe if companies were inconvenienced by having to pay £100 to each impacted person they may take security a little more seriously.

    Whose head will roll over this I wonder ?

    Bet it isn’t anyone senior.

  • Mark says:
    8 Sep8 September 08:20

    I did a booking during the affected period but no email. I used my saved data on ba.com so does this mean not affected or just my email address etc been affected? I’m guessing that ba have a lot more than 380k books in 15 or so days so fingers crossed I’m not affected by virtue of no email!

  • Sue Bentley says:
    8 Sep8 September 08:21

    I bought a BA upgrade with my BA Amex during the time frame they advertise when the breach happened. I have only had an email from BA Amex saying ‘do nothing’ basically! I’m away from home at present so will wait till I get home later to see if any transactions have taken place apart from mine. I am currently using another card. Should I cancel the Amex card just in case?

    • Anna says:
      8 Sep8 September 08:42

      Can you get the Amex app? This lists all transactions so you can check it whenever you like. I find it really useful to keep track of our spending.

      • Yuff says:
        8 Sep8 September 08:51

        If you have your card linked to Apple Pay every time there has a transaction, on the card, it comes up on your phone

        • Trickster says:
          8 Sep8 September 22:22

          Unfortunately I think that’s not accurate. It only does that if you use Apple Pay. What you are describing is the feature where to can add an Amex card via the app into Apple Wallet, then it will pop up for all transactions, regardless where transaction.

          Sadly, Amex emailed last night to say they are discontinuing the apple wallet card, presumably in favour of Apple Pay, so I imagine the alert feature will go.

  • Graham says:
    8 Sep8 September 08:23

    I have received the ba letters because I used a registered card which is now compromised. I have a second card registered with ba, but which I haven’t used. Does anyone know whether or not this would be affected, please ?

  • AndyR says:
    8 Sep8 September 08:24

    Rob, you say no flight data is transferred but if you check your Amex statements you can see for any flights purchased that Amex do have flight data including ticket number. How do they get this information if not during payment?

    • Rob says:
      8 Sep8 September 08:30

      Not sure, but clearly Visa and Mastercard do not get it or they would show it too. It is unlikely to be sent to WorldPay or whichever payment processor is used.

    • Paul says:
      8 Sep8 September 08:55

      Interesting comment and I don’t have an answer just an observation.
      Initially a transaction shows as a single purchase and this is what is approved. That requires the Security code and the transaction is pending. A few days later the transaction changed to individual purchases by ticket, even when bought as a single transaction. This is when the travel details are clear,
      I don’t know if other card issuers do this but it would suggest a second or third exchange of data which won’t the include security codes as they are not retained.

  • BJ says:
    8 Sep8 September 08:29

    “There is no sign of Alex’s hi-viz vest yet”

    Zeus, sorry I meant Alex, has probably swapped his hi-viz vest for an aegis this week.

  • MDA says:
    8 Sep8 September 08:39

    FYI details like this are usually sold on the dark web for as little as $5

  • Paul says:
    8 Sep8 September 08:48

    The first email from BA was not compliant with GDPR and I wrote to their DPO and complained using the form letter provided by the ICO website. I imagine many others and the ICO did too which would explain the second missive received late last night. It’s typical of BA that the communications in times of disruption and like this communications are dire. Further evidence of their lack of resources, lack of focus, lack of concern. I think the fine will be significant as the ICO will want to make an example. I was also struck by the tone of BA communications and calling the activity criminal. Yes it was but it just felt that they were trying to divert attention away from their own failings from the get go.
    Alex is toast! Maybe not today or even this year but he’s finished. We were spared the high vis but he looked awful on the TV in an ill fitting suit and oozes failure. At his level I would have expected that media training including how you look, not just what you say would have been important. Even Rob knew to wear his best TV shirt!
    Amex have again shone, communicating quickly and clearly and providing reassurance. I will however request new cards once the fuss dies down. For anyone with pre paid or pre booked car hire in the US, remember ( if your card has been changed) that you need the original payment card (as I found out to my cost in August) so make sure car rental firms know before you go.
    BAs compensation promise is as hollow as their data protection promise which they tout on their substandard web site. Credit card firms will cover all costs of fraud but how do you compensate for just being concerned, for the grief incurred by changing things or taking protective measures.

    It is a shambles and one that BA should pay a hefty price for

    • Ahe_g says:
      8 Sep8 September 10:30

      Agree with above comments, this is terrible. Don’t know why Cruz wasn’t sacked over the last IT fiasco.

This article is closed to new comments. Feel free to ask your question in the HfP forums.

New to Head for Points?

Welcome!  We’re the UK’s most-read source of business travel, Avios, frequent flyer and hotel loyalty news. Let us improve how you travel. Got any questions? Ask them in our forums.

Get 25,000 Avios with the Barclaycard Avios Plus Mastercard

GET A SIGN-UP BONUS OF 18,000 VIRGIN POINTS!

Latest Forum Posts

Get 80,000 bonus points (worth 80,000 Avios) and £400 of dining credit with The Platinum Card (Offer ends 27th May)

Check reward flight availability instantly for free!

See a whole year of reward seat availability on one page at SeatSpy.com

Get up to 10,000 bonus Hilton Honors points

Booking a luxury hotel?

Our luxury hotel booking service offers you GUARANTEED extra benefits over booking direct. Works with Four Seasons, Mandarin Oriental, The Ritz Carlton, St Regis and more. We've booked £1.7 million of rooms to date. Click for details.

SME? GET THE ONLY FREE SMALL BUSINESS CREDIT CARD WHICH CAN EARN AVIOS

Get points worth 30,000 Avios with 'first year free' American Express Gold (ends 27th May)

The UK's biggest frequent flyer website uses cookies, which you can block via your browser settings. Continuing implies your consent to this policy. Our privacy policy is here.

Got it!