Around 9 million easyJet customers have had their data breached in a ‘sophisticated’ cyber-attack, the airline has announced.
Email addresses and travel details were stolen by cyber-criminals and more than 2,200 customers have also had their credit and debit card details ‘accessed’, including CVV numbers.
The ICO
easyJet informed the UK’s Information Commissioner’s Office in January 2020 and they are currently investigating the breach. It wasn’t until four months later that easyJet informed its customers.
“People have a right to expect that organisations will handle their personal information securely and responsibly. When that doesn’t happen, we will investigate and take robust action where necessary,” an ICO spokesperson told the BBC.
To justify the length of time it took them to inform customers, easyJet told the BBC: “This was a highly sophisticated attacker. It took time to understand the scope of the attack and to identify who had been impacted.”
“We could only inform people once the investigation had progressed enough that we were able to identify whether any individuals have been affected, then who had been impacted and what information had been accessed.”
Why did the attack happen?
No details were shared about the nature of the attack, the motives, or the reason easyJet’s security measures did not prevent it. It was suggested that hackers were targeting ‘company intellectual property’ rather than information that could be used in identity theft, but no evidence was given to support that claim.
“We are advising customers to be cautious of any communications purporting to come from easyJet or easyJet Holidays,” it warned.
The ICO warned easyJet customers to be extra cautious of phishing attacks during its investigation period.
The effects of a data breach
Personal details can be used by cyber criminals to access bank accounts, open new accounts, and take out loans in the victims’ names. They may also use your information to make fraudulent purchases or sell on to other criminals.
Firm Update
Please be advised that we are no longer accepting claims for the easyJet data breach litigation.
We are aware that other firms are still taking on new clients, and we would recommend that you reach out to them should you still wish to bring a claim.
Thank you for your understanding.
