> series: anatomy_of_a_breach —— part: 117 —— target: british_airways —— cards: 380,000 —— proposed_fine: £183,000,000<span class="cursor-blink">_</span>_
On 6 September 2018, British Airways disclosed that personal and financial data — including names, addresses, email addresses, and complete payment card details (numbers, expiry dates, and CVV codes) — had been stolen from approximately 380,000 customers who made bookings through the BA website and mobile app between 21 August and 5 September 2018. The attack used a Magecart-style technique: the attackers had injected approximately 22 lines of malicious JavaScript into BA's payment page, capturing every card detail entered by customers and exfiltrating them to a server controlled by the attackers.
The ICO's investigation found that BA could have prevented the breach through readily available security measures. In July 2019, the ICO announced its intention to fine BA £183 million — 1.5% of BA's worldwide annual turnover — the largest GDPR fine ever proposed. The fine was subsequently reduced to £20 million (in the context of the COVID-19 pandemic's impact on the aviation industry), but the initial £183 million figure sent a seismic signal across UK business: GDPR enforcement was real, and the ICO intended to use its new powers.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe BA Magecart attack was surgically precise: approximately 22 lines of malicious JavaScript were injected into the BA payment page, overriding the legitimate form submission process to copy card details — including the CVV — to an attacker-controlled domain (baways.com) before passing the data to BA's legitimate payment processor. The attack operated on both the website and the mobile app (which used the same payment page code), and the malicious domain name was specifically chosen to appear legitimate at first glance.
The BA fine was the moment GDPR enforcement became tangible for UK businesses. A household-name airline, a payment card breach affecting hundreds of thousands of UK customers, and a proposed fine of £183 million — the largest ever under any data protection regime worldwide. For every UK board of directors, the BA case answered the question 'Will the ICO actually impose large GDPR fines?' with an unequivocal yes.
For UK organisations handling payment data, the BA breach established clear expectations: payment page security must include client-side controls (CSP, SRI, script monitoring), not just server-side measures. Web application testing must cover both. PCI DSS testing must assess Magecart defences. Cyber Essentials certification demonstrates the baseline the ICO expects. SOC in a Box monitors for script injection in real-time. And UK Cyber Defence provides the incident response capability that limits breach scope and demonstrates cooperation to the ICO.
Our <a href="/penetration-testing/web-application">web application testing</a> assesses Magecart defences. <a href="/cyber-essentials">Cyber Essentials</a> demonstrates appropriate measures. <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects script injection.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call