On 22 June 2018, an attacker entered British Airways’ network using stolen credentials from Swissport, a third-party cargo handler. The account lacked multi-factor authentication, and the intruder later escaped a Citrix virtual environment, found privileged usernames and passwords stored in accessible files, and reached a database administrator account by 26 June. The UK Information Commissioner’s Office (ICO) found that BA had also been logging payment-card data, including CVVs, in plaintext since December 2015 because a testing feature was mistakenly left active in production. Up to 108,000 cards were potentially exposed through 95 days of retained logs.
Between 14 and 25 August 2018, the attacker inserted 22 lines of JavaScript into BA’s checkout pages, copying customer payment data to the attacker-controlled “BAways” domain while transactions appeared normal. The ICO determined that data relating to about 429,612 people was accessible, including names, addresses, card numbers, expiry dates, and CVVs for roughly 244,000 customers. BA removed the code within 90 minutes of notification on 5 September and informed the ICO and affected customers on 6 September. The ICO’s proposed £183.39 million GDPR penalty was reduced after mitigation and COVID-19 hardship considerations to £20 million, issued on 16 October 2020. Customer group litigation was settled out of court in 2021.
