By C.R. for The Economist
It is not a message any frequent flyer looks forward to receiving. On 7 September, British Airways (BA) said it had emailed over 380 000 customers who had booked flights with the carrier between 21 August and 5 September admitting that their credit-card details had been stolen by hackers.
BA’s embattled chief executive, Alex Cruz, attributed the breach to a “malicious, fairly sophisticated attack” on its website. The airline thinks the hackers obtained names, street and e-mail addresses, and credit-card numbers, expiry dates and security codes—more than enough information to steal money from bank and credit-card accounts.
Mr Cruz has promised compensation for any customers financially affected by the hack.
The airline has not released the full details of what happened, and is still investigating the breach. But it has admitted that it was only data used in transactions in that 15-day period, not saved credit-card data on customer accounts, that was stolen.
Cyber-security experts say that hack sounds like it breached the system that managed customer payments, unlike previous attacks on other big companies where saved data was stolen.
Whatever the cause of the attack, aviation analysts think BA is likely to be hit hard by fines from regulators. Under the EU’s new General Data Protection Regulation, which came into force in May, BA could face a fine of up to 4% of its revenues if it is determined that it did not do enough to protect customer information.
That would be around £500m ($650m). If regulators decide that the penalty should be levied on the entire revenues of IAG, BA’s parent, that number could swell to as much as €1bn ($1.16bn). After adding the cost of compensating customers affected by the breach, it is no wonder that the group’s shares dropped in value by 2% on the morning the news became public.
But analysts are wary about saying that the hack will affect BA or IAG’s longer term performance.
BA has been hit by a serious of complaints about falling standards of service on its flight and by a computer crash that stranded 75,000 of its passengers last May. Mr Cruz has been crucified in the media for both public-relations meltdowns. Yet neither issue has really affected demand for BA flights.
So why do BA passengers keep coming back to the airline, in spite of it losing their credit-card data, checked-in baggage and taking away free nosh onboard? The answer is that they have little choice.
New airlines simply cannot take market share away from BA at Heathrow. As long as it uses each take-off and landing slot it is allocated 80% of the time, it can keep it for the next season. As a result, the share of slots at Heathrow owned by BA’s parent has risen from 36% in 1999 to 54%. It has also been gobbling up slots at Gatwick from defunct airlines such as Monarch, to make sure Norwegian, a disruptive long-haul low-cost competitor, cannot get their hands on them.
However much the airline’s computer systems go wrong or it cuts back its level of service onboard, new competitors cannot push it off the runway. Another IT disaster will not change that.