Air Europa suffers a major data breach with full credit card details exposed

This article is closed to new comments. Feel free to ask your question in the HfP forums.

• Skywalker says:

  12 Oct12 October 08:48

  Revolut has a single-use “card” which renews itself after every use, and a multi-use online “card”, which is good for retailers that do not accept single-use cards.

  If there is a security breach such as this, this allows people to generate another multi-use online usage card without affecting their physical payment cards.

  I have often wondered why in this day and age (especially when we are looking at plastic usage), other major card providers/issuers have not implemented something similar.

  • PeteM says:

    12 Oct12 October 08:54

    People don’t like having to enter card details over and over?

    • Skywalker says:

      12 Oct12 October 09:18

      That may be some people’s preferences (not all), I was actually asking about the card companies…

  • John says:

    12 Oct12 October 09:21

    I wonder how much it costs revolut to issue a new virtual card? I have used some of them for payments of 10p or less – and I also use them to receive money (I wish it was possible to generate disposable bank account numbers)

    • Ed says:

      12 Oct12 October 09:59

      The rate card we get from our supplier is 8p to activate and then a 12p residence fee per active month.

      Assuming ~£30 fee for a chargeback; you can issue at least 150 single-use cards for every charge back you eliminate.

    • Mr. AC says:

      12 Oct12 October 11:10

      How are you receiving money with a card number? Is there a service that allows you to send money to a card?

  • Sunguy says:

    12 Oct12 October 12:39

    Revolut managed to setup an account against my email address about 16 months ago – and have so far not managed to be bothered to do anything useful….

    This is despite complaints, both formal, informal and to their data protection team …. they really do not care, they are not interested and have no way of making a complaint such as this….

    They are not particularly trustworthy IMHO …..

    • ADS says:

      12 Oct12 October 18:53

      Please report this incident to the FCA

      FCA are in the process of deciding whether Revolut should be given a full UK banking licence

• Lady London says:

  12 Oct12 October 09:15

  Another source said Air Europa was only fined 600,000 euros for their last breach.

  Any chance of them being fined a starter level serious-ish amount instead say USD20 million, for this one?

  I’ve recently had recurring tries on common accounts like microsoft, twitter and linked in, notified to me a few times over the past 2 or 3 weeks. The only hack I’m aware my data could have been stolen in in was British Airways and my transactions were just outside the times they notified.

  Meanwhile 2nd level authentication continues to be a pain the way many sites implement it and as far as I can tell, often not that effective if you assume someone’s stolen your phone as well.

  • Reno says:

    12 Oct12 October 09:52

    Check if your online accounts are part of other breaches on “haveibeenpwned” (I’m not providing the link to avoid my comment being marked as spam). It’s likely your details have been compromised elsewhere.
    Password managers like 1Password have a feature that automatically checks for you btw

    • Lady London says:

      12 Oct12 October 12:56

      no new notices received from haveibeenpened since the BA one and that must be 2 or 3 years ago now. Though I was in On Business and have been wondering of the OB problems have been linked with an uneecognised breach since BA certainly won’t be able to afford to annoince another breach by now!

• Man of Kent says:

  12 Oct12 October 09:55

  I find it odd they haven’t mentioned when the breach actually occurred rather than saying it’s been recently detected. If I was being cynical is there any coincidence this has been discovered and disclosed at a time they are undergoing due diligence for a sale?

  • Bagoly says:

    12 Oct12 October 18:40

    I’m slightly more worried that it suggests they don’t have logs good enough to know!

• Colin MacKinnon says:

  12 Oct12 October 10:36

  Contrast the approach by dna test firm 23andme in this morning’s email. First two paragraphs:

  “We want to provide you with an important update and recommended actions.

  “What happened?
  We recently learned that certain profile information – which a customer creates and chooses to share with their genetic relatives in the DNA Relatives feature – was accessed from individual 23andMe.com accounts.”

  PS. Actual DNA security doesn’t hugely worry me: no kids, only child, both parents dead – so I am the “Last of the Clan”.

  But I know the data for my mother is not actually my mother’s – so that protects someone who actually has kids and grandkids!

• Bervios says:

  12 Oct12 October 11:18

  Motel one have just emailed members as well to advise they have been subject to a data breach and credit card details
  have been exposed.

• jannis says:

  12 Oct12 October 12:07

  every business should support Apple Pay!!!!

  • Rob says:

    12 Oct12 October 12:11

    Depends how keen they are to pay 0.5% to Apple ….

    • WorldTraveller says:

      12 Oct12 October 12:32

      Apple Pay doesn’t cost anything to merchants. Only banks have to pay a small commission to Apple and it is much less than 0.5%. There is an article about this on wikipedia which quotes 7+ sources.

• Adam says:

  12 Oct12 October 12:59

  As this is CVV data it can only be an intercept on the traffic to their site. That’s down to some really shoddy security controls or actually more likely that access credentials have been compromised which have enabled these naughty types to update their payload onto the webpage in full view of Air Europa but would be undetected as there’s no sign of inflitration.

  • modestpointscollector says:

    12 Oct12 October 16:38

    You are making the assumption that they’re handling the input data correctly. There’s nothing to stop a terrible developer just saving the information somewhere for re-billing instead of the token.

    • modestpointscollector says:

      12 Oct12 October 16:39

      But I agree it is much more likely to be something like a Magecart attack or similar.

• Bagoly says:

  12 Oct12 October 18:39

  Given how bad that email is, should not the Spanish Data Regulator be all over them insisting on a better one – particularly clarifying the date range?
  Of course they shouldn’t have to intervene, but they are supposed to provide such second line action.

This article is closed to new comments. Feel free to ask your question in the HfP forums.