Anatomy of a Breach: Ticketmaster UK and Dixons Carphone — The UK's Summer of Breaches Under GDPR

GDPR was five weeks old. Two major UK breaches hit simultaneously.

On 27 June 2018 — just 33 days after GDPR came into force — Ticketmaster UK disclosed that a malicious JavaScript payload embedded in a third-party customer support chatbot (provided by Inbenta Technologies) had been used to skim payment card details from up to 40,000 UK customers. The attack was an early example of Magecart — a collective term for threat groups that inject card-skimming JavaScript into e-commerce websites. The malicious code captured card numbers, expiry dates, and CVVs as customers entered them on the Ticketmaster checkout page.

Days earlier, Dixons Carphone had disclosed a breach affecting approximately 10 million customer records and 5.9 million payment card details — a breach that had been active since July 2017, predating GDPR. The ICO would later fine Dixons Carphone £500,000 under the pre-GDPR DPA (since the breach occurred before 25 May 2018) and Ticketmaster £1.25 million under GDPR. The twin disclosures — both involving UK household names, both involving payment card data, both in the first weeks of GDPR — put UK corporate cybersecurity under intense public and regulatory scrutiny.

The supply chain skimmer that would define 2018.

The Ticketmaster breach introduced the UK public to Magecart — a threat methodology where attackers inject malicious JavaScript into e-commerce websites (either directly or through compromised third-party scripts) to capture payment card data in real-time as customers enter it during checkout. Unlike traditional card breaches that target databases or POS systems, Magecart operates in the browser — capturing data before it reaches the server.

Third-party scripts on payment pages are your responsibility.

The Ticketmaster breach established that organisations are responsible for the security of third-party code running on their payment pages. Under GDPR and PCI DSS, the fact that a compromise came through a vendor's script does not absolve the organisation hosting the script. Web application testing assesses third-party script security, Content Security Policy implementation, and Subresource Integrity deployment. PCI DSS testing validates payment page security. Cyber Essentials establishes baseline controls. SOC in a Box monitors for script injection in real-time. And UK Cyber Defence provides incident response when Magecart-style attacks are detected.

Related Articles