British Airways (BA) has revealed all its staff who are paid in the UK have been caught up in a cyber incident that has exposed personal data including bank and contact details to hackers.

It emerged last week that a so-called zero-day vulnerability – a flaw – in the file transfer system MOVEit, produced by Progress Software, had been exploited by cyber criminals.

It had allowed the hackers to access information on a range of global companies using MOVEit Transfer.

Be the first to get Breaking News

Install the Sky News app for free

Thousands of firms are understood to be affected.

UK-based payroll provider Zellis confirmed on Monday that eight of its clients were among them.

It did not name the organisations.

BA, however, confirmed it had been caught up in the affair.

Cost of living – latest: Universal basic income to be trialled in England for first time – with participants being paid for doing nothing for two years

New business group launched to rival CBI ahead of key vote

Six Nations backer CVC plots £4bn takeover of Center Parcs

The airline employs 34,000 people in the UK.

Boots, which has 50,000 staff, said it had been affected too.

The Telegraph newspaper reported that the BBC was also among those to have been caught up in the hacking which, it added, was being linked to a Russia-based group.

There has been

The compromised information includes contact details, national insurance numbers and bank details.

BA told Sky News: “We have been informed that we are one of the companies impacted by Zellis’ cybersecurity incident which occurred via one of their third-party suppliers called MOVEit.

“Zellis provides payroll support services to hundreds of companies in the UK, of which we are one.

“This incident happened because of a new and previously unknown vulnerability in a widely used MOVEit file transfer tool. We have notified those colleagues whose personal information has been compromised to provide support and advice.”

A Boots spokesperson said: “A global data vulnerability, which affected a third-party software used by one of our payroll providers, included some of our team members’ personal details.

“Our provider assured us that immediate steps were taken to disable the server, and as a priority we have made our team members aware.”

Zellis said in its own statement: “A large number of companies around the world have been affected by a zero-day vulnerability in Progress Software’s MOVEit Transfer product.

“We can confirm that a small number of our customers have been impacted by this global issue and we are actively working to support them.

“All Zellis-owned software is unaffected and there are no associated incidents or compromises to any other part of our IT estate.

“Once we became aware of this incident we took immediate action, disconnecting the server that utilises MOVEit software and engaging an expert external security incident response team to assist with forensic analysis and ongoing monitoring.”

Related posts:

UK reports another 40 coronavirus deaths and 2,678 cases Prioritising COVID booster jabs over vaccinating children will ‘reduce deaths and hospitalisations’ Nearly 200 people fall ill with salmonella poisoning linked to pork scratching factory BBC journalist Amol Rajan apologises for ‘rude and immature’ comments about royals Stranded British travellers face spending Christmas in COVID quarantine hotels ‘The system is so unjust’: Police should be compelled to tell truth by law, bereaved families say Rishi Sunak asks PM to refer him to adviser on ministers’ interests Migrant crossings double as more than 8,000 have made it to UK this year England’s all-time record women’s goalscorer announces her retirement ‘Her life has been stolen’: Family pay tribute to Basildon mum after police find body Man arrested on suspicion of murdering Elle Edwards in pub on Christmas Eve CCTV shows thieves snatch £60,000 diamond ring then flee in getaway car