Latest BA email indicates that full name, billing address, email address and payment card information were all lifted. From previous experience, this gives the ability to set up things like home shopping accounts.
When I moved home a couple of years back, someone set up a Very account in my name, ordering a number of laptops for delivery to “another” address. The transaction was not successfully completed, but remedying it was painful.

i can’t do much about my name and address, but I can at least cancel the card.