DATA BREACH NOTIFICATION FROM EASYJET
On May 28, 2020, a public announcement about a data breach published on the website of the Turkish Personal Data Protection Authority. According to the announcement, under the provision of Article 12, Paragraph 5 of the Law on the Protection of Personal Data, EasyJet Plc (“EasyJet”) sent a notification to the Turkish Data Protection Board (“the Board”) on 26.05.2020. With this notification, EasyJet has informed the Board as a data controller on these subjects;
- EasyJet was exposed to an information security issue by high-level attackers that led to access to personal data,
- The breach occurred between 17.10.2019 and 04.03.2020,
- EasyJet became aware of the unauthorized access to its systems on 22.01.2020, and detected a specially produced malware that obtains passenger reservation information on 10.03.2020,
- Between the people who were affected by the breach on 20.5.2020, 6.846 of them were residing in Turkey (based on the billing addresses reported by customers when making the reservation)
- Among 6.846 people, the personal data of the 3 people who were affected by the breach were communication information (name, surname and e-mail address), flight information (flight departure date, departure point, destination, and ticket reference), transaction information (transaction amount and type) and payment information (card number as a non-tokenized plain text, expiration date, and CVV information). The personal data of the other 6.843 people who are affected by the breach were communication information (name, surname and e-mail address), flight information (flight departure date, departure point, destination, and ticket reference ), transaction information (transaction amount and type),
Although the investigation on the subject is still ongoing, with the decision of the Board dated 28.05.2020 and numbered 2020/443 it was decided that to announce the notification of the data breach on the website of the Board.
You can find the text of the public announcement (in Turkish) here.
Should you have any queries and/or remarks, please do not hesitate to contact us.