Credit card details of hundreds of thousands of British Airways customers were stolen over a two-week period in the most serious attack on its website and app.
It immediately contacted customers when the extent of the breach became clear.
Around 380,000 card payments were compromised.
Hackers obtained names, street and email addresses, credit card numbers, expiry dates and security codes.
The attack came 15 months after the carrier suffered a massive computer system failure at London's Heathrow airport, which stranded 75,000 customers over a holiday weekend.
The attackers had not broken the airline's encryption but did not explain exactly how they had obtained the customer information.
The attackers had probably targeted a gateway between the airline and a payment processor because no travel details had been stolen.
BA advised customers to contact their bank or credit card provider and follow their recommended advice.
"id": "BRI45811122",
"linkid": "british-airways",
"type": "Data Leak",
"date": "09/2018",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"
Join the conversation