British Airways
Disclosed Sep 6, 20188 years ago429,612 affectedSettled
2018 web skimming attack exposed over 400,000 customers; ICO fine of GBP 20M
Using credentials stolen from a Swissport employee, an attacker entered BA's network in June 2018 and later injected 22 lines of JavaScript into its website to skim payment details from late August to September 5, 2018. The ICO first proposed a GBP 183.39M fine in 2019 and issued a final GBP 20M penalty in October 2020.
What is known
| People affected | 429,612 (as reported by the organization) |
|---|---|
| Disclosed | Sep 6, 2018 |
| Discovered | Sep 5, 2018 |
| Happened | Oct 21, 2018 |
| Attack | Hacking |
| Data exposed | Names, Addresses, Payment cards, Emails, Credentials and tokens, Financial |
| Sector | Transport · US |
| Status | Settled |
| Lawsuit or fine | GBP 20M ICO fine (Oct 2020), reduced from a proposed GBP 183.39M (about $26M) |
Sources
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Sep 6, 2018 | 429,612 |
| Researchtotal | Sep 6, 2018 | |
| Indiana AGresidents of IN | Sep 7, 2018 | 176 |
| Maine AGresidents of ME | Sep 7, 2018 | 71 |
| Maine AGresidents of ME | Oct 24, 2018 | 1 |
| California AGresidents of CA | Nov 21, 2018 | |
| Washington AGresidents of WA | Nov 21, 2018 | 1,588 |
| Oregon DOJresidents of OR | Nov 21, 2018 | 429,000 |
Other breaches at British Airways
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Staff payroll data including bank details taken in Zellis MOVEit breachJun 5, 20233 years agoVendor breachUnverified | Jun 5, 20233 years ago | Vendor breach | Transport | Unverified | Unknown |
History of this record
- 2026-09-25 · data_types: ["names","addresses","payment-card","emails","credentials"] to ["names","addresses","payment-card","emails","credentials","financial"] · backfill source
- 2026-09-25 · source: empty to https://www.maine.gov/ag/sites/maine.gov.ag/files/docs/Data%20breach%20spreadsheet%208-1-2021%20through%2012-5-2018%20REDACTED.xlsx · backfill source
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-date-Report-2018.pdf · backfill source
- 2026-09-25 · fine_usd: 26000000 to 25800000 · seed source
- 2026-09-25 · lawsuit: 20M GBP ICO fine (2020) to GBP 20M ICO fine (Oct 2020), reduced from a proposed GBP 183.39M · seed source
- 2026-09-25 · data_types: ["names","addresses","payment-card","emails"] to ["names","addresses","payment-card","emails","credentials"] · seed source
- 2026-09-25 · summary: British Airways said payment data from about 380,000 transactions on its website and app was stolen between August 21 and September 5, 2018. The ICO fined it 20 million GBP for a breach affecting more than 400,000 customers. to Using credentials stolen from a Swissport employee, an attacker entered BA's network in June 2018 and later injected 22 lines of JavaScript into its website to skim payment details from late August to September 5, 2018. The ICO first propos · seed source
- 2026-09-25 · title: Card skimming script on BA website and app hits hundreds of thousands to 2018 web skimming attack exposed over 400,000 customers; ICO fine of GBP 20M · seed source
- 2026-09-25 · status: confirmed to settled · seed source
- 2026-09-25 · fine_usd: empty to 26000000 · seed source
- 2026-09-25 · lawsuit: empty to 20M GBP ICO fine (2020) · seed source
- 2026-09-25 · data_types: [] to ["names","addresses","payment-card","emails"] · seed source
- 2026-09-25 · records_basis: empty to organization · seed source
- 2026-09-25 · records: empty to 429612 · seed source
- 2026-09-25 · disclosed: 2018-11-21 to 2018-09-06 · seed source
- 2026-09-25 · summary: empty to British Airways said payment data from about 380,000 transactions on its website and app was stolen between August 21 and September 5, 2018. The ICO fined it 20 million GBP for a breach affecting more than 400,000 customers. · seed source
- 2026-09-25 · title: empty to Card skimming script on BA website and app hits hundreds of thousands · seed source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2018-09-05 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.