![This photo taken on August 4, 2020 shows Prince, a member of the hacking group Red Hacker Alliance who refused to give his real name, using his computer at their office in Dongguan, China's southern Guangdong province. - From a small, dingy office tucked away in an industrial city in southern China, one of China's last "volunteer hacker" groups maintains a final outpost in its patriotic hacking war. (Photo by NICOLAS ASFOURI / AFP) / TO GO WITH China-hacking-security,FOCUS by Laurie Chen / The erroneous mention[s] appearing in the metadata of this photo by NICOLAS ASFOURI has been modified in AFP systems in the following, we removed the HOLD HOLD HOLD in the main caption. Please immediately remove the erroneous mention[s] from all your online services and delete it (them) from your servers. If you have been authorized by AFP to distribute it (them) to third parties, please ensure that the same actions are carried out by them. Failure to promptly comply with these instructions will entail liability on your part for any continued or post notification usage. Therefore we thank you very much for all your attention and prompt action. We are sorry for the inconvenience this notification may cause and remain at your disposal for any further information you may require. (Photo by NICOLAS ASFOURI/AFP via Getty Images)](https://media.cnn.com/api/v1/images/stellar/prod/210621154549-hackers-keyboard.jpg?q=x_0,y_131,h_1419,w_2523,c_crop/w_250)
Hackers have stolen the data of millions of EasyJet customers, including thousands of credit card numbers, the budget airline said in a statement on Tuesday.
A “sophisticated source” had accessed the email address and travel details of approximately 9 million customers, and the credit card details of 2,208, the company said.
EasyJet (ESYJY)did not say when the attack took place. It said it was contacting all customers affected to offer support, and was working with the UK Information Commissioner’s Office (ICO) and National Cyber Security Centre.
EasyJet CEO Johan Lundgren apologized to customers, and he cited the coronavirus pandemic as a possible incentive for hackers.
“Since we became aware of the incident, it has become clear that owing to Covid-19 there is heightened concern about personal data being used for online scams,” Lundgren said. “As a result, and on the recommendation of the ICO, we are contacting those customers whose travel information was accessed and we are advising them to be extra vigilant, particularly if they receive unsolicited communications.”
The ICO told CNN Business that it is continuing to investigate the incident.
“People have the right to expect that organizations will handle their personal information securely and responsibly. When that doesn’t happen, we will investigate and take robust action where necessary,” an ICO spokesperson said.
“Anyone affected by data breaches needs to be particularly vigilant to possible phishing attacks, and scam messages. We have published advice on our website about how to spot potential phishing emails,” the spokesperson added.
EasyJet grounded all 334 of its planes in Europe in March as a result of travel restrictions across the region due to the pandemic, only operating rescue flights to repatriate citizens.
The airline has not confirmed when it will start flying again, telling customers it is currently canceling flights on a seven-day rolling basis, though flights are available for booking on the company’s website from May 29.
