[dethos]

Both the BBC article and the incident notice (shared in other comments) contain very few details about the "highly sophisticated cyber-attack".

When such details are omitted I tend to suspect that "highly sophisticated" is sugarcoating some kind of negligence or bad security practices.

[cjrp]

Ditto. What if "highly sophisticated" actually means "stumbled upon easyjet.com/backups/latest_db_dump_w_passwords-SENSITIVE.sql"