This article needs additional citations for verification. (October 2021) |
The EasyJet data breach was a cyberattack on the computer systems of British airline EasyJet.[1][2]
Discovery
editEasyJet first learned of the cyberattack at the end of January 2020.[1][2] Approximately nine million people were affected with the credit card details of 2,208 also accessed.[1] EasyJet notified the Information Commissioner's Office while they were investigating the breach.[1]
Public admission
editEasyJet publicly revealed the attack in May 2020.[1] They told the BBC that they were only able to notify customers whose details (credit card or email addresses) were stolen in April 2020.[1] EasyJet told BBC "This was a highly sophisticated attacker. It took time to understand the scope of the attack and to identify who had been impacted".[1] They also said "We could only inform people once the investigation had progressed enough that we were able to identify whether any individuals have been affected, then who had been impacted and what information had been accessed".[1]
The affected data covers flight bookings made from 17 October 2019 to 4 March 2020.[2]
The stolen credit card details include the card security code.[1]
EasyJet said they had gone public to notify the nine million customers whose email addresses had been accessed to beware of phishing attacks and that it would notify everybody by 26 May.[1] Passengers whose credit card details were accessed were notified in April.[2] They did not reveal details of the attack but said it seemed to be aimed at "company intellectual property" rather than information that could be used in identity theft.[1]
EasyJet was not obliged to notify passengers whose basic booking details were compromised but they announced the details because of an increase in phishing attacks during the COVID-19 pandemic.[2] Passport details were not accessed.[2]
The Information Commissioner's Office said they were investigating.[1] The ICO said "People have a right to expect that organisations will handle their personal information securely and responsibly. When that doesn't happen, we will investigate and take robust action where necessary".[1]
GDPR requires companies to store personal details securely and EasyJet could face fines from the ICO of 4% of the airlines' turnover in 2019.[2]