BAEC Account Hacked
I had an email last night from BAEC informing me that I'd changed my email address, and had I not initiated this change, to contact them immediately. As the UK office was closed, I called the US phone number. 90 minutes later, I managed to freeze the account, and I'm currently awaiting a telephone call from the audit team today to discuss.
Whoever hacked the account also changed the account address, which meant I was unable to pass the security questions when I called BAEC, which caused what would've been a short telephone call into a 90-minute one. During that time, I have little doubt that they emptied the Avios balance.
No call from BA as of yet, but I wanted to know what to expect. Will everything be reinstated as it should be, or is it going to be more complicated? I have no idea how they got in, as I take my online security seriously. I'm guessing it was brute forced (come on BA...two-step authentication would be nice!). But obviously, my personal data would have also been compromised.
Should I worry about my separate Avios account, and my Lloyds credit card? Or is this situation much, much worse than that?