What personal information do they have that they could not have gathered by other means? The BA email says full name, billing address and email address.

There is so much information of that nature which can be found online already: have you ever bought a house, mortgaged it, applied to the local authority to add an extension to it, been on an electoral register etc?

Contrast it with the Nordics for example where all your personal data (including date of birth and income!) is publicly available online. No more identity theft than here is reported.

So while I am very concerned about ID theft in general, the BA situation has not added to my concern.

And given I am not worried about card fraud as I will be reimbursed for any such event, I can sleep soundly and not waste time calling cards companies, banks etc.

Side comment, why are people all wanting to suddenly change their BA.com password? This has not been communicated as having been accesses. Again, it is good practice to regularly change password but why specifically in that instance - BA has not even recommended to do so.