Incident: A changed script nobody was watching

Module 7 · Incident file · About 35 minutes

What happened

On 16 October 2020 the UK Information Commissioner's Office (ICO) fined British Airways (BA) £20 million for a cyber attack that ran from 22 June to 5 September 2018. Everything in this file comes from the ICO's penalty notice of that date (ICO, British Airways penalty notice, 16 October 2020), which redacts some technical detail. BA did not admit liability. This is a summary of a regulator's document, not legal advice.

The attacker signed in to BA's Citrix remote access gateway with credentials BA had issued to an employee of Swissport, "a third-party provider of cargo services to BA". From there the attacker reached the wider network, and between 14 and 25 August changed code on britishairways.com so that payment card data was copied to BAways.com, a site the attacker controlled. The change "remained active on BA's website for a period of 15 days", from 21 August to 5 September, and bookings carried on as normal while it ran.

On 5 September 2018 "a third party informed BA" that data was being sent to BAways.com. Within 90 minutes BA had contained it; 20 minutes later it blocked the paths to the attacker's site. BA notified the ICO the next day, and the notice says it "acted promptly" in doing so. About 429,612 people were potentially affected, 244,000 of them with name, address, card number and CVV. The ICO had announced an intention to fine £183.39 million in July 2019. The final notice set £30 million in principle, cut it by 20% for mitigating factors to £24 million, and by a further £4 million for the impact of Covid-19.