Low-cost airline Easyjet said this morning that hackers had obtained the email and travel details of 9m customers, and the credit card details of a further 2,000.
In a statement, the firm said: “There is no evidence that any personal information of any nature has been misused.
“However, we are communicating with the approximately 9m customers whose travel details were accessed to advise them of protective steps to minimise any risk of potential phishing”.
In total, the credit card details of 2,208 customers were accessed, the group revealed in a regulatory filing.
It added: “We’re sorry that this has happened, and we would like to reassure customers that we take the safety and security of their information very seriously”.
Easyjet said that those customers who had been affected by the hack would be notified by 26 May at the latest.
It added that customers should be wary of any emails coming from Easyjet or Easyjet Holidays.
The carrier is working with the Information Commissioner’s Office (ICO) and National Cyber Security Centre.
Last year, British Airways was fined £183m by the ICO after hackers harvested the details of 500,000 customers.
Andrew Tsonchev, director of technology at cyber defence firm Darktrace, said:
“18 months after British Airways suffered a major data breach, it is not surprising that airline companies continue to be a target for cyber attackers, particularly at a time when the industry is suffering from financial woes and reduced workforce due to furloughing.
“This is another wake-up call to businesses that they need to step up to the challenge, and invest in innovations such as AI that are suited to monitoring and protecting very distributed digital systems.
“Security teams alone cannot keep up with the speed and stealth of today’s attackers”.
The hack comes a few days before Easyjet’s board will go head-to-head with founder Stelios Haji-Ioannou over the carrier’s new aircraft contract with Airbus.
An extraordinary general meeting is set for Friday, at which shareholders will vote on Haji-Ioannou’s resolutions to dismiss the chairman, chief executive, and finance head over the deal.