Breachesby GlyphBritish Airways
Disclosed Sep 6, 2018429,612 affectedSettled
2018 web skimming attack exposed over 400,000 customers; ICO fine of GBP 20M
Using credentials stolen from a Swissport employee, an attacker entered BA's network in June 2018 and later injected 22 lines of JavaScript into its website to skim payment details from late August to September 5, 2018. The ICO first proposed a GBP 183.39M fine in 2019 and issued a final GBP 20M penalty in October 2020.
What is known
| People affected | 429,612 (as reported by the organization) |
|---|---|
| Disclosed | Sep 6, 2018 |
| Discovered | Sep 5, 2018 |
| Happened | Oct 21, 2018 |
| Attack | Hacking |
| Data exposed | NamesAddressesPayment cardsEmailsCredentials and tokensFinancial |
| Sector | Transport · US |
| Status | Settled |
| Lawsuit or fine | GBP 20M ICO fine (Oct 2020), reduced from a proposed GBP 183.39M (about $26M) |
Sources
California Attorney General breach notice: British AirwaysWashington Attorney General breach notice: British AirwaysOregon DOJ breach notice: British AirwaysBritish Airways fined 20m GBP over data breachBritish Airways boss apologises for malicious data breachBritish Airways data breach (Wikipedia)British Airways customer data stolen in data breachUK's ICO fines British Airways a record GBP 183MUK's ICO reduces British Airways data breach fine to GBP 20MIndiana Attorney General 2018 data breach report: British AirwaysMaine Attorney General breach notice archive: British AirwaysMaine Attorney General breach notice archive: British Airways
Notices filed
Other breaches at British Airways
History of this record
["names","addresses","payment-card","emails","credentials"] to ["names","addresses","payment-card","emails","credentials","financial"]by backfillSource
empty to https://www.maine.gov/ag/sites/maine.gov.ag/files/docs/Data%20breach%20spreadsheet%208-1-2021%20through%2012-5-2018%20REDACTED.xlsxby backfillSource
empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-date-Report-2018.pdfby backfillSource
26000000 to 25800000by seedSource
20M GBP ICO fine (2020) to GBP 20M ICO fine (Oct 2020), reduced from a proposed GBP 183.39Mby seedSource
["names","addresses","payment-card","emails"] to ["names","addresses","payment-card","emails","credentials"]by seedSource
British Airways said payment data from about 380,000 transactions on its website and app was stolen between August 21 and September 5, 2018. The ICO fined it 20 million GBP for a breach affecting more than 400,000 customers. to Using credentials stolen from a Swissport employee, an attacker entered BA's network in June 2018 and later injected 22 lines of JavaScript into its website to skim payment details from late August to September 5, 2018. The ICO first proposby seedSource
Card skimming script on BA website and app hits hundreds of thousands to 2018 web skimming attack exposed over 400,000 customers; ICO fine of GBP 20Mby seedSource
confirmed to settledby seedSource
empty to 26000000by seedSource
empty to 20M GBP ICO fine (2020)by seedSource
[] to ["names","addresses","payment-card","emails"]by seedSource
empty to organizationby seedSource
empty to 429612by seedSource
2018-11-21 to 2018-09-06by seedSource
empty to British Airways said payment data from about 380,000 transactions on its website and app was stolen between August 21 and September 5, 2018. The ICO fined it 20 million GBP for a breach affecting more than 400,000 customers.by seedSource
empty to Card skimming script on BA website and app hits hundreds of thousandsby seedSource
unknown to hackingby backfillSource
empty to 2018-09-05by backfillSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.