British Airways britishairways.com British Airways data breach 2018: what happened and what to do
Between June 22 and September 5, 2018, attackers skimmed payment details from British Airways customers through a lookalike site. The UK's ICO estimated about 429,612 people may have had data accessed and fined the airline £20 million in October 2020.
View all 13,115 breaches- Breach date
- 22 Jun 2018
- Made public
- 6 Sept 2018
- Affected
- 429,612
- Data exposed
- Names, Physical addresses, Credit card numbers, Card security codes
- Last updated
What happened
The UK Information Commissioner's Office (ICO) calls the incident "the Attack" and dates it from June 22 to September 5, 2018. People paying on the British Airways site were silently sent to a lookalike site, BAways.com, which captured their payment details. A third party alerted the airline.
The ICO estimated that about 429,612 people may have had personal data accessed. About 244,000 of them had their name, address, card number and CVV exposed.
What was exposed
For the largest group: name, address, payment card number and the three-digit security code. With those, a criminal can make online card purchases. Names and addresses also make phishing messages that claim to come from the airline or your bank more believable.
The regulator's response
The ICO found British Airways had not kept customer data secure enough under the UK GDPR. It fined the airline £20 million on October 16, 2020, down from the £183 million it first proposed. The ICO noted that British Airways reported the incident promptly and cooperated fully. British Airways did not admit liability.
What to do if you were in it
- 1
Check card statements from mid-2018
If you booked or paid on the British Airways site or app in that window, look for charges you don't recognize. Cards from then have almost certainly expired or been replaced, but ask your bank about any dispute.
- 2
Be skeptical of messages about flights and refunds
Names and addresses can feed phishing that mentions your booking. Go to the airline's app or site yourself instead of clicking links.
- 3
Use a unique password for your airline account
If you used the same password elsewhere, change it there too and turn on two-factor login where it's offered.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the British Airways data breach?
Customers who paid on the British Airways website or app between June 22 and September 5, 2018 may have been. The ICO estimated about 429,612 people.
What was exposed in the British Airways data breach?
For about 244,000 people, name, address, payment card number and CVV. Other groups had fewer card details exposed.
Was British Airways fined?
Yes. The ICO fined British Airways £20 million on October 16, 2020, after first proposing £183 million.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
