British Airways and BBC staff data stolen in MOVEit related cyber breach

British Airways employees are among the victims of a data breach caused by the exploited vulnerability of MOVEit.

The hackers gained unauthorized access to national insurance numbers, salaries, contact details, sort codes, and account numbers of staff employed by the UK's airline. Today the airline informed its employees about the breach.

The breach occurred through a cyberattack on payroll company Zellis, which utilized the file transfer tool. Zellis provides payroll support services to numerous companies in the UK, including British Airways. It's confirmed that eight companies were impacted by the breach of Zellis, although the names of the affected organizations are not disclosed.

Subsequently a spokesperson for the BBC also confirmed that the company was “aware of a data breach at our third party supplier, Zellis, and are working closely with them as they urgently investigate the extent of the breach,” but said they don’t believe that employees’ bank account details were compromised.

It was confirmed that anyone who has worked for the BBC in a staff or freelance position over the last few years had their personal details in the file, including name, date of birth, national insurance number and home address. BBC has notified all current and former staff and freelancers.

Zellis' website indicates that it provides services to 42 companies in the FTSE 100, including prominent firms such as BP, Coca-Cola, GSK, Tesco, and Vodafone. Zellis has worked with various organizations, including White Stuff, the Irish Health Service Executive, Yodel, Bidfood, Cromwell, Leonardo, and two UK councils.

The identity of the attackers remains unknown, and so far there have been no reports of criminal groups extorting victims on the dark web with the stolen data.