The 2018 British Airways breach exposed the personal and payment details of several hundred thousand customers after attackers injected malicious code into the airline’s website and app to skim data as customers entered it. It is a landmark example of a Magecart-style attack and led to a major regulatory penalty.
What happened
In 2018, British Airways disclosed that attackers had compromised its website and mobile app, stealing the personal and payment details of several hundred thousand customers. What made the incident notable was how the data was stolen. Rather than breaking into a database and extracting stored records, the attackers stole the data in real time, as customers typed it in, by injecting malicious code into the airline’s own digital channels.
The breach became one of the defining examples of a web skimming attack, and it carried consequences beyond the theft itself, including a significant regulatory penalty that signalled how seriously data protection authorities were prepared to treat such failures.
How the attack worked
The attackers used a technique commonly associated with a set of groups known collectively as Magecart. Instead of attacking stored data, they compromised the British Airways website and app and inserted malicious code, a digital skimmer. When customers entered their personal and payment details to make a booking, that code captured the information as it was typed and sent it to the attackers, all while the legitimate transaction proceeded normally.
This is the digital equivalent of a card skimmer placed on a payment terminal. Everything looked and worked as expected to the customer, the booking went through, nothing seemed wrong, while their data was being copied in the background. The attack is effective precisely because it is invisible to the victim.
What was exposed
The stolen data included personal details and payment card information for several hundred thousand customers, captured directly as they entered it. Because the skimmer collected data at the moment of entry, it captured exactly what customers typed, including the payment details needed for fraud. This kind of directly harvested payment data is immediately valuable to criminals and highly damaging to those affected.
The personal information exposed also carries lasting risk, supporting fraud and targeted phishing well after the incident. As with any breach of this kind, the exposure did not end when the attack was stopped.
Why web skimming attacks are so effective
Web skimming, or formjacking, is dangerous for several reasons. It is invisible, because the legitimate site keeps working normally while data is stolen, so nothing alerts the customer. It captures data at the point of entry, meaning even data that is not stored in a vulnerable database can be taken. And it can persist undetected for a long time, quietly harvesting data from every customer until the malicious code is found and removed.
These attacks also exploit the trust customers place in a legitimate, familiar website. Customers had every reason to trust the British Airways site, which is exactly why the attack worked. That combination of invisibility, real-time capture and abuse of trust is what has made web skimming a persistent threat to any organisation that takes payments online.
The regulatory consequences
The British Airways breach is also remembered for its regulatory aftermath. Data protection authorities imposed a significant penalty, reflecting the sensitivity of the data, the number of people affected, and expectations around protecting customer information. It was a clear signal that failing to secure customer data carries real financial and reputational consequences, not just the direct cost of the breach.
For organisations everywhere, the case reinforced that data protection is a legal and financial obligation, and that the security of customer-facing digital channels is squarely within scope.
Why monitoring for exposed customer and payment data matters
Web skimming attacks capture data that flows quickly to criminals and into the dark web economy, where stolen payment and personal data is traded. Monitoring for that exposed data provides early warning, allowing an organisation to respond faster to protect affected customers, and helping individuals know when their information has surfaced.
DarkThreatX monitors Tor, Telegram and I2P around the clock, along with forums and marketplaces, tracking more than 100 billion records with alerts in under five minutes when exposed data appears. No single source has full coverage of the dark web, and DarkThreatX maintains broad Telegram monitoring across these networks. Early awareness of exposed customer and payment data is part of limiting the damage once a breach has occurred.
To watch for exposed customer and payment data, explore enterprise dark web monitoring or dark web monitoring for financial services.
For a detailed account, see reputable reporting on the British Airways breach.
Frequently asked questions
What happened in the British Airways breach?
Attackers compromised the British Airways website and app and injected malicious code that skimmed customers’ personal and payment details in real time, as they were entered, during 2018. It affected several hundred thousand customers and led to a major regulatory penalty.
What was exposed?
Personal details and payment card information for several hundred thousand customers, captured directly as they typed it in. Because the data was harvested at the point of entry, it included the payment details needed for fraud.
What is a Magecart attack?
A Magecart, or web skimming, attack steals data directly from a website as users enter it, by injecting malicious code into the site. It is invisible to the customer because the legitimate site keeps working normally while their data is copied in the background.
Why was the British Airways breach significant?
It was a landmark example of a web skimming attack against a major, trusted brand, and it led to a significant regulatory penalty. That penalty signalled that failing to protect customer data carries serious financial and reputational consequences.
