O award wallet lancou um comunicado rebatendo acusações:
OK, so BA accounts have been hacked today and many folks are concerned that this was related to AwardWallet. We can assure you - we have not been hacked. We have researched this situation thoroughly and here is what we are seeing:
http://onemileatatime.boardingarea.com/2015/03/27/missing-british-airways-avios-youre-not-alone/" onclick="window.open(this.href);return false;
>>>>According the agent I spoke with, over a million accounts were affected
We have a total of 51,523 BA accounts and 12,069 had a zero balance on AwardWallet yesterday. Today 12,950 have a zero balance so 881 BA accounts dropped to zero since yesterday. Yes this is a lot but why wouldn't more of them drop if we were hacked? Also we checked AwardWallet accounts that had BA accounts that we know for a fact were hacked - they had 10+ other loyalty accounts with large balances on AwardWallet, if they were hacked why would the hackers only pick a single provider - BA? This makes no sense.
Also BA is saying:
We understand this was login information relating to a different online service which you may have also used to access your Executive Club account.
We think this is likely the case. Many of us use the same username and password combination on different websites, so if your BA combination was username: "JSmith" password: "bluesky" and you used the same combination to login to abcd.com and abcd.com was compromised then hackers could have tried using these credentials against the BA's website to get into your account. That way we can see how millions of accounts could have been affected.
Also, please review our security practices here:
https://awardwallet.com/faqs.php#10" onclick="window.open(this.href);return false;
We particiapte in a bounty bug hunt with Crowdcurity
https://www.crowdcurity.com/awardwallet/" onclick="window.open(this.href);return false; where we pay hackers to find security issues with our service.
Finally for the techies out there here is more info:
Your AwardWallet passwords are hashed with bcrypt, cost:13, plus unique salt for each user.
For the passwords that users store locally on their computers we use Rjindael (similar to AES), 256 bit.
The "remember me" cookie is a sha 256 hash of certain user attributes
Loyalty account passwords are encrypted with 1024 RSA key.
If someone is trying to brute-force your account we will lock them out for a period of time after few invalid login attempts.