Maximise your Avios, air miles and hotel points

Air Europa suffers a major data breach with full credit card details exposed

Links on Head for Points may support the site by paying a commission.  See here for all partner links.

Air Europa, the Spanish airline which BA’s parent IAG is currently in the process of acquiring, appears to have suffered from a data breach.

The email sent out to customers over the weekend should, I think, serve as an example of how not to do this.

Rather than rewrite the story, I thought I’d share the email with you, with comments!

Air Europa credit card breach

Dear Customer:

At AIR EUROPA we are committed to the security and privacy of our customers. In light of this, we work daily to apply the best practices in the sector and comply with current regulations.

They are SO committed to the security and privacy of your data that they appear to have spent very little on cybersecurity, because:

In accordance with this commitment, we inform you that a cybersecurity incident was recently detected in one of our systems consisting of possible unauthorized access to your bank card data, specifically the following:

• The number of the bank card ending in XXXX
• The expiration date of that card.
• The CVV of the card.

Say what?! You thought you’d casually mention half-way down that all of my credit card information, including the CVV code, has been exposed?!

From the first moment we have put all our resources to contain the incident, adopting all the necessary technical and organizational measures. Thanks to this, we have secured our systems, guaranteeing the correct functioning of the service. Additionally, we have made the due notifications to the competent authorities and necessary entities (AEPD, INCIBE, banks, etc.).

That’s nice. How about telling me what you’re going to do to help me with my compromised credit card?

Air Europa credit card breach

Given the risk of card spoofing and fraud that this incident could entail, and in order to protect your interests, we recommend that you take the following steps:

1. Identify the card used to make payment(s) on the AIR EUROPA website.
2. Contact your bank.
3. Request the cancellation/cancellation/replacement of that card in order to prevent possible fraudulent use of your information.
4. Do not provide personal information, your pin, name or any other personal data through telephone, message or email, even when they are identified as your bank.
5. Do not click on links that warn you of fraudulent operations. Contact your bank directly by verifiable means.
6. Collect any evidence of possible unauthorized use of your card and report it to the State Security Forces.

So, Air Europa isn’t actually going to do anything to help me then ….

Our goal is to prevent similar situations from occurring in the future, as well as to minimize the possible inconvenience that all this may cause.

Bit late for that, I suspect – and I don’t see you doing anything to ‘minimize the possible inconvenience’ of your passengers. It’s also not ‘possible’ inconvenience, it IS inconvenience if my credit card has to be cancelled.

We apologise for the damages we may have caused you and we are at your complete disposal for any clarification or additional resolution of doubts you may need. Also, if you want more information about the management of the security breach, contact our Data Protection Officer at the mail: delegadopd@aireuropa.com.

Best regards,
Air Europa

Category

General

Comments (73)

This article is closed to new comments. Feel free to ask your question in the HfP forums.

  • Peter says:
    12 Oct12 October 04:14

    Wait, companies *store* your CVV when you make an online purchase?

    • stevenhp1987 says:
      12 Oct12 October 07:26

      No, that’s against PCI DSS.

      • Thywillbedone says:
        12 Oct12 October 07:58

        I thought storing it was permitted but only if it is encrypted?

        • Max says:
          12 Oct12 October 21:29

          There is absolutely no reason to save the CVV. Once you have done the initial payment, the merchant should only save the payment token which can be reused for further billings.

      • plunet says:
        12 Oct12 October 08:07

        PCI DSS stipulates the standards that MUST be applied when a merchant processes the card number (PAN), the expiry date, the CVV among other details. Retailers can store such data themselves but to do so requires a very high technical and security bar (which includes encryption and many other controls) that most choose not to do so and outsource that to a specialist payment services provider. So it’s not impossible for a retailer to manage this themselves but the requirements are so significant that most don’t.

    • TimM says:
      12 Oct12 October 07:31

      Amazon, Ali Express among many others.

      • yorkieflyer says:
        12 Oct12 October 07:46

        Oft wondered this, it was definitely against card scheme rules to store CVV when I was in this game years ago

      • S says:
        12 Oct12 October 09:43

        CVV isn’t required to process a payment. So Amazon doesn’t store your CVV, they just don’t ask for it. They are prepared to absorb the risks and costs involved for a simpler user experience.

        • AL says:
          12 Oct12 October 23:34

          CVV proves you physically have the card, which is ascertainable in other ways – usually, when a vendor calls out to the issuer to make the decision. Often the issuer will invoke TOTP, and you end up with a code.

          Concur that there is no reason to store CVV. It’s pretty poor on Air Europa’s part to have done so. Pretending it’s needed for recurring authority is also not an excuse – that can happen without.

  • Gordon says:
    12 Oct12 October 04:30

    “At AIR EUROPA we are committed to the security and privacy of our customers”

    When there’s a data breach or similar occurrence with a company, there’s always the above starting sentence!

    Well you obviously don’t as the horse has already bolted. Do these companies have adequate security in place to protect customers personal data. Probably not so it seems!

  • Martin says:
    12 Oct12 October 04:43

    I received something similar from other companies over the last few years..
    I’ve still not been robbed even though I’m told my passwords are available to buy on the dark Web..
    I find that amazing as I can’t even remember log in passwords for myself.!!

    • PeteM says:
      12 Oct12 October 07:09

      Perhaps worth considering starting using a password manager like 1Password if you’re not already. Wouldn’t help here, but would in the more common situations where usernames and password get stolen.

  • Andrew (@andrewseftel) says:
    12 Oct12 October 05:43

    I’m not a massive expert on the merchant side of PCI DSS, but generally merchants shouldn’t be storing CVVs at all (pre authorization, perhaps), so it’s surprising that they are in a data breach.

    • sigma421 says:
      12 Oct12 October 06:34

      It could be an interception attack like BA faced rather than a straightforward data breach. They’re very vague about what has actually happened.

      • Andrew (@andrewseftel) says:
        12 Oct12 October 07:14

        Fair point

      • SamG says:
        12 Oct12 October 09:06

        That’d be my assumption too. Some airline systems were / are quite behind the absolute best practices when it comes to handling card data but I’m pretty sure by now none are holding CVV

        • SamG says:
          12 Oct12 October 09:06

          *once processed. Which can mean it hangs around a couple of days whilst a ticket is issued

          • Max says:
            12 Oct12 October 21:31

            It should absolutely not hang around for days. The moment the ‘pay now’ (or similar) button is clicked, the system should generate a payment token which can be stored.

  • sigma421 says:
    12 Oct12 October 06:32

    They’ll fit in great at IAG!

  • Jon says:
    12 Oct12 October 07:01

    “Now then Air Europa, here at IAG we’re committed to ensuring all our airlines operate to the same standards, so before we can complete our acquisition of you, have you had any cybersecurity breaches that you’ve made a complete hash of dealing with?”

    “Um… give us a few minutes… There, all done.”

    “Great, you’ll fit right in, welcome to IAG.”

  • Jon says:
    12 Oct12 October 07:06

    Also, that’s the most bullshitty arse-covering email I think I’ve seen in a long time. What was the subject line? Something like “Air Europa launches new cybersecurity initiative to ensure your data is safe”?! 😉

  • Vistaro says:
    12 Oct12 October 07:08

    Clearly they’ve totally messed up and we can all decide for ourselves if it will stop us using them.

    What extra do you think they could have done to reduce the inconvenience? I doubt they can contact your bank for you (or the myriad of other companies the card is used with so that your details can be updated with your new card)

    Really not trying to defend them in any way, it’s a mess and one that could have been avoided.

    • PeteM says:
      12 Oct12 October 08:52

      Companies in the UK and US often offer credit monitoring services when this happens. A bit harder I suppose when your customers are all over the world and not sure if this sort of service is available in Spain, where most of their customers are.

      • mkcol says:
        12 Oct12 October 13:57

        UK companies have done it for their foreign customers, as has a foreign company done it for me, so Air Europa certainly can choose to do so.

        Or not.

This article is closed to new comments. Feel free to ask your question in the HfP forums.

New to Head for Points?

Welcome!  We’re the UK’s most-read source of business travel, Avios, frequent flyer and hotel loyalty news. Let us improve how you travel. Got any questions? Ask them in our forums.

Get 25,000 Avios with the Barclaycard Avios Plus Mastercard

GET A SIGN-UP BONUS OF 18,000 VIRGIN POINTS!

Latest Forum Posts

Get 80,000 bonus points (worth 80,000 Avios) and £400 of dining credit with The Platinum Card (Offer ends 27th May)

Check reward flight availability instantly for free!

See a whole year of reward seat availability on one page at SeatSpy.com

Get up to 10,000 bonus Hilton Honors points

Booking a luxury hotel?

Our luxury hotel booking service offers you GUARANTEED extra benefits over booking direct. Works with Four Seasons, Mandarin Oriental, The Ritz Carlton, St Regis and more. We've booked £1.7 million of rooms to date. Click for details.

SME? GET THE ONLY FREE SMALL BUSINESS CREDIT CARD WHICH CAN EARN AVIOS

Get points worth 30,000 Avios with 'first year free' American Express Gold (ends 27th May)

The UK's biggest frequent flyer website uses cookies, which you can block via your browser settings. Continuing implies your consent to this policy. Our privacy policy is here.

Got it!