EasyJet has admitted that a “highly sophisticated cyber-attack” has affected approximately nine million customers.
It said email addresses and travel details had been stolen and that 2,208 customers had also had their credit card details “accessed”.
The firm has informed the UK’s Information Commissioner’s Office while it investigates the breach.
EasyJet first became aware of the attack in January.
It told the BBC that it was only able to notify customers whose credit card details were stolen in early April.
“This was a highly sophisticated attacker. It took time to understand the scope of the attack and to identify who had been impacted,” the airline told the BBC.
“We could only inform people once the investigation had progressed enough that we were able to identify whether any individuals have been affected, then who had been impacted and what information had been accessed.”
Stolen credit card data included the three digital security code – known as the CVV number – on the back of the card itself.
EasyJet added that it had gone public now in order to warn the nine million customers whose email addresses had been stolen to be wary of phishing attacks.
It said that it would notify everyone affected by 26 May.
It did not provide details about the nature of the attack or the motives, but said its investigation suggested hackers were targeting “company intellectual property” rather than information that could be used in identity theft.
“There is no evidence that any personal information of any nature has been misused, however, on the recommendation of the ICO, we are communicating with the approximately nine million customers whose travel details were accessed to advise them of protective steps to minimise any risk of potential phishing.
“We are advising customers to be cautious of any communications purporting to come from EasyJet or EasyJet Holidays.”
In response to the breach, the ICO said that it was investigating.
“People have a right to expect that organisations will handle their personal information securely and responsibly. When that doesn’t happen, we will investigate and take robust action where necessary.”
It also warned people to be on the lookout for phishing attacks and directed them to its advice on its website on how to spot such scams.
Phishing
Phishing attempts – which see criminals sending emails with links to fake web pages that steal personal data – have risen exponentially during the coronavirus crisis.
Google is blocking more than 100 million phishing emails every day to Gmail users.
It is likely that hackers will take advantage of the fact people are cancelling flights because of the uncertainty related to the spread of Covid-19, said Ray Walsh, a digital privacy expert at ProPrivacy.
“Anybody who has ever purchased an EasyJet flight is advised to be extremely wary when opening emails from now on,” he said.
“Phishing emails that leverage data stolen during the attack could be used as an attack vector at any point in the future.
“As a result, it is important for customers to be vigilant whenever they receive unsolicited emails or emails that appear to be from EasyJet, as these could be fake emails which link to cloned websites designed to steal your data.”
Turbulent times
The coronavirus pandemic has meant an end to much global travel, leaving airlines struggling financially.
“These are already turbulent times for all companies within the aviation industry but the situation has just got significantly worse for EasyJet,” said Mike Fenton, chief executive of threat detection firm Redscan.
“To add to the company’s woes, it is now has to explain how the personal records of nine million customers were able to be accessed.
“When it comes to cyber security, the airline industry doesn’t have a great record. The British Airways breach in 2018 should have been a wake-up call and passenger confidence is likely to be at an all-time low after this.”
Source:Â bbc.com