EasyJet has suffered a serious cyber-security breach resulting in the personal details of over 9 million customers being exposed, along with the details of thousands of credit cards.
The personal details of over 9 million EasyJet customers were illegally accessed in what the firm is describing as a "highly sophisticated" cyber-attack. The breach did not involve passport details, but a total of 2,208 customers' credit card information was obtained. If your credit card details were stolen as part of the attack, you will already have been contacted.
The breach included contact details, email addresses, and travel details for all affected customers, which a third party could use as part of a phishing attempt. EasyJet is recommending that anyone who has travel plans with the company should be very wary of anyone unexpectedly contacting them about their travel plans. Affected customers will be contacted over the next week to let them know if they were part of the breach.
The last time a major airline in the UK was breached was last year's British Airways cyber-attack that resulted in a fine of £183m levied by the UK Information Commissioner's Office (ICO) under GDPR legislation. That breach involved only half a million users' data being exposed, while the EasyJet breach has exposed the personal information of over 9 million customers and 2,208 customers' credit card details.
The severity of the action taken by the ICO against EasyJet will naturally depend on the scale of the breach, but also on other factors such as how preventable the breach was. The British Airways data breach was determined to be caused by a piece of outdated third-party javascript on the website that should have been kept up to date. EasyJet has described the attack as "highly sophisticated" but the ICO will no doubt conduct its own investigation to determine whether it was avoidable.
Source: The Guardian
