As British Airways reels from yet another IT scandal, speculation about how the “world’s favourite airline” could allow the credit card details of 380,000 customers to be stolen from under its nose for two weeks swirls.
Answers on exactly how the criminals were able to steal the credit card information are thin on the ground and will likely require BA or a third-party security contractor to divulge details.
Data breaches can take many forms, from simply leaving sensitive security data on USB flash drives on west London streets, to blackmail, social engineering, disgruntled ex- or current employees and intrusion attempts exploiting one or multiple weaknesses in a company’s cybersecurity.
However, statements so far point to point to a different scenario to that experienced by Dixons Carphone earlier this year. BA says only personal and financial data was taken, and only from those purchasing flights between 21 August and 5 September when the hack was active, not those with credit cards saved on their accounts.
Where Dixons Carphone had historic data on 10 million customers stolen by cybercriminals gaining access to databases, this new “very sophisticated” hack – in the words of BA’s CEO – appears to have only taken data as it was entered into the system during the purchasing process.
“One possibility is that hackers compromised a flaw in the software on British Airways’ website,” Richard Walters, the chief technology officer of the security firm CensorNet, said. “It is speculation until further details emerge but an attacker could then upload information stealing code to the website, which could intercept messages with backend systems, including financial data.
“If this is the case, a copy of data would be sent to the criminals as it was relayed to the company’s main IT infrastructure. This kind of attack could also have affected the app if they use common systems.”
The National Crime Agency said it is investigating the breach. A spokesman for the Information Commissioner’s Office said it would also be making inquiries about the data theft.
“Perhaps most significantly, this is one of the first major breaches since GDPR came into effect in May,” Walters said. “It appears that the company notified the Information Commissioner’s Office and customers within the GDPR’s mandatory 72 hours but the breach will now be investigated and the company could be penalised if it failed to take all the necessary measures to protect customer data.”
Full details on precisely how this attack happened, and any possible punitive actions including fines for BA, may only be revealed months down the line.
In the meantime, experts say the consequences for those affected by the theft are likely to roll out over time.
“Once hackers have hold of high-value data like card details, the market in criminal networks for reselling is huge, meaning that we may not see the effects of this theft immediately until a buyer acts,” Leigh Anne Galloway, the cyber security resilience lead at Positive Technologies, said. “The best thing to do for anyone who thinks their details may have been involved, or who has been told so by BA, should keep an eye on their transactions. Consider cancelling the affected bank card and request a replacement for peace of mind.”
