On 22 June 2018, an attacker gained access to the British Airways network by means of
compromised login detailsa stolen username and passwordfrom an employee of
Swissport, a third-party cargo handler. The compromised account did not have
multi-factor authentication (MFA) enabled, a security measure that requires a second step in addition to a password, such as a code sent to a phone. British Airways later found that the attacker had compromised five such Swissport accounts. The accounts allowed the attacker to access only a limited set of applications and data within a virtual environment provided by the
Citrix platform, which British Airways used to let staff and partners run internal applications over the internet. However, the attacker was able to break out of that environment. Having done so, they found a file containing the username and password of a highly privileged user saved to a file that could be accessed by any user of the domain.
Discovery On 5 September 2018, a third party informed British Airways that data from its website was being sent to a third-party site, indicating that the site had been compromised. Within 90 minutes, British Airways removed the malicious code. On 6 September, British Airways informed the ICO and 496,636 affected customers. The statement said that the breach had been resolved, the website was operating functionally, and that British Airways had notified the police and relevant authorities and was contacting affected customers. The attackers obtained names, street addresses, email addresses, credit card numbers, expiry dates and card security codes – enough to allow malicious actors to steal from accounts. British Airways urged customers to contact their banks or credit card issuer and to follow their advice.
NatWest said that it received more calls than usual because of the breach.
American Express said that customers would not need to take any action and that they would alert customers with unusual activity on their cards. == Perpetrators ==