British Airways says an attack on its site and app on Aug. 21-Sept. 5 exposed customers' personal and financial details, believes ~380K “card payments” breached
British Airways revealed on Thursday that hackers managed to lurk in its systems for two weeks, exposing around 380,000 card payments.
Context & Ripple Effects
British Airways disclosed that attackers sat inside its website and app from Aug. 21 to Sept. 5 — a two-week dwell time long enough to harvest roughly 380,000 card payments along with customers' personal and financial details. The disclosure came days after the window closed, meaning affected customers were transacting with compromised checkout the entire time.
The breach lands as UK regulators are newly armed under GDPR to penalize data failures, and within days RiskIQ's forensics tied the attack to Magecart, the skimming group whose identical tactics had just surfaced at Ticketmaster. The same airline would later appear again in breach coverage when the Progress MOVEit tool hack swept up its staff data in 2023.
First-order effects
- Around 380,000 customers who paid through BA's site or app during the Aug. 21–Sept. 5 window have exposed card and personal data, forcing bank-side card reissuance and fraud monitoring for anyone who transacted in that period.
Second-order effects
- RiskIQ's attribution to Magecart — active since 2015 and using tactics matching its recent Ticketmaster breach — turns this from a one-off incident into evidence of a group systematically targeting payment pages across brands, pushing other e-commerce operators to audit their own checkout scripts.
Third-order effects
- The ICO's subsequent record £183M fine against British Airways established that a single skimming attack can carry GDPR-scale financial consequences, making website payment integrity a board-level compliance cost rather than an IT footnote — a pattern echoed later by third-party-platform breaches like Qantas' 2025 disclosure of 6M customers' data.
The trend: Web-payment skimming is evolving from isolated incidents into a recurring criminal industry, and regulators are converting each major breach into precedent-setting penalties.