British Airways website theft: Customers urged to contact banks as airline launches investigation over stolen data

Around 380,000 payment cards 'compromised' over two-week period

British Airways (BA) is investigating "as a matter of urgency" the theft of customer data from its website and has urged customers affected to contact their banks or credit card providers.

Between 21 August and 5 September, personal and financial details of around 380,000 payment cards belonging to customers making bookings "were compromised", BA confirmed.

The airline added it had notified police after the stolen data, which did not include travel or passport details, was taken from ba.com and its mobile app.

British Airways is likely to face many claims from customers who either suffer a financial loss as a result of fraud, or simply incur costs from having to 'reboot' their financial settings.

The airline may be handed a stiff fine from the Information Commissioner’s Office. A cyber attack on TalkTalk in 2015 which affected fewer than half as many customers resulted in a record £400,000 fine.

The reputational damage could be more serious. The data breach is unconnected with the “power outage” that triggered a collapse of the airline’s information systems in May 2017 and the cancellation of hundreds of flights over a bank holiday weekend.

But it will add to an impression that BA has serious IT shortcomings.

"The breach has been resolved and our website is working normally," the airline said in a statement.

"British Airways is communicating with affected customers and we advise any customers who believe they may have been affected by this incident to contact their banks or credit card providers and follow their recommended advice.

A spokesperson told The Independent the breach was identified when "a third party noticed some unusual activity and informed us about it".

"We immediately acted to close down the issue, and started an investigation as a matter of urgency."

Alex Cruz, BA's chairman and chief executive, said in a statement: "We are deeply sorry for the disruption that this criminal activity has caused.

"We take the protection of our customers' data very seriously."