In an official statement, the low-cost airline apologised, said that the unauthorised access had since been blocked and affected customers would be contacted in the coming days and customers.

“Since we became aware of the incident, it has become clear that owing to covid-19 there is heightened concern about personal data being used for online scams. As a result, and on the recommendation of the [British data regulator] ICO, we are contacting those customers whose travel information was accessed and we are advising them to be extra vigilant, particularly if they receive unsolicited communications,” easyJet chief executive officer Johan Lundgren said in a statement.

Of the 9 million customers whose email addresses and flight details were accessed, easyJet said there was no evidence that any personal information had been misused. But it will still notify the customers to advise them of steps to minimise the risk of phishing.

“We are advising customers to continue to be alert as they would normally be, especially should they receive any unsolicited communications. We also advise customers to be cautious of any communications purporting to come from easyJet or easyJet Holidays,” the statement read. Customers affected by the breach will be contacted no later than 26 May.