British Airline EasyJet Suffers Data Breach Exposing 9 Million Customers’ Data

In an official statement^[1]
released today, EasyJet confirmed that of the 9 million affected
users, a small subset of customers, i.e., 2,208 customers, have
also had their credit card details stolen, though no passport
details were accessed.

The airline did not disclose precisely how the breach happened,
when it happened, when the company discovered it, how the
sophisticated attackers unauthorizedly managed to gain access to
the private information of its customers, and for how long they had
that access to the airline’s systems.

However, EasyJet assured its users that the company had closed off
the unauthorized access following the discovery and that it found
“no evidence that any personal information of any nature has been
misused” by the attackers.

“As soon as we became aware of the attack, we took immediate
steps to respond to and manage the incident and engaged leading
forensic experts to investigate the issue,” the company said in a
statement published today.

EasyJet has also notified the Information Commissioner’s Office
(ICO), Britain’s data protection agency, and continues to
investigate the breach incident to determine its extent and further
enhance its security environment.

“We take the cybersecurity of our systems very seriously and
have robust security measures in place to protect our customers’
personal information. However, this is an evolving threat as cyber
attackers get ever more sophisticated,” says EasyJet Chief
Executive Officer Johan Lundgren.

“Since we became aware of the incident, it has become clear that
owing to COVID-19, there is heightened concern about personal data
being used for online scams. Every business must continue to stay
agile to stay ahead of the threat.”

As a precautionary measure recommended by the ICO, the airline
has started contacting all customers whose travel and credit card
details were accessed in the breach to advise them to be “extra
vigilant, particularly if they receive unsolicited
communications.”

Affected customers will be notified by May 26.

Last year, the ICO fined British Airways with a record of £183
million^[2] for failing to protect
the personal information of around half a million of its customers
during a 2018 security
breach^[3] incident involving a
Magecart-style
card-skimming attack^[4]
on its website.

Affected customers should be suspicious of phishing emails,
which are usually the next step of cybercriminals to trick users
into giving away further details of their accounts like passwords
and banking information.

Affected customers exposing their credit card details are
advised to block the affected cards and request a new one from
their respective financial institution, and always keep a close eye
on your bank and payment card statements for any unusual activity
and report to the bank if you find any.