This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.
You can find the current article at its original source at https://www.theguardian.com/business/2018/sep/07/ba-says-hack-hit-only-those-buying-tickets-in-two-week-period
The article has changed 6 times. There is an RSS feed of changes available.
| Version 1 | Version 2 |
|---|---|
| How did hackers manage to lift the details of BA customers? | How did hackers manage to lift the details of BA customers? |
| (35 minutes later) | |
| As British Airways reels from yet another IT scandal, speculation about how the “world’s favourite airline” could allow the credit card details of 380,000 customers to be stolen from under its nose for two weeks swirls. | As British Airways reels from yet another IT scandal, speculation about how the “world’s favourite airline” could allow the credit card details of 380,000 customers to be stolen from under its nose for two weeks swirls. |
| Answers on exactly how the criminals were able to steal the credit card information are thin on the ground and will likely require BA or a third-party security contractor to divulge details. | |
| Data breaches can take many forms, from simply leaving sensitive security data on USB flash drives on west London streets, to blackmail, social engineering, disgruntled ex- or current employees and intrusion attempts exploiting one or multiple weaknesses in a company’s cybersecurity. | Data breaches can take many forms, from simply leaving sensitive security data on USB flash drives on west London streets, to blackmail, social engineering, disgruntled ex- or current employees and intrusion attempts exploiting one or multiple weaknesses in a company’s cybersecurity. |
| However, statements so far point to point to a different scenario to that experienced by Carphone Warehouse earlier this year. BA says only personal and financial data was taken, and only from those purchasing flights between 21 August and 5 September when the hack was active, not those with credit cards saved on their accounts. | However, statements so far point to point to a different scenario to that experienced by Carphone Warehouse earlier this year. BA says only personal and financial data was taken, and only from those purchasing flights between 21 August and 5 September when the hack was active, not those with credit cards saved on their accounts. |
| Where Carphone Warehouse had historic data on 10 million customers stolen by cybercriminals gaining access to databases, this new “very sophisticated” hack – in the words of BA’s CEO – appears to have only taken data as it was entered into the system during the purchasing process. | Where Carphone Warehouse had historic data on 10 million customers stolen by cybercriminals gaining access to databases, this new “very sophisticated” hack – in the words of BA’s CEO – appears to have only taken data as it was entered into the system during the purchasing process. |
| “One possibility is that hackers compromised a flaw in the software on British Airways’ website,” Richard Walters, the chief technology officer of the security firm CensorNet, said. “It is speculation until further details emerge but an attacker could then upload information stealing code to the website, which could intercept messages with backend systems, including financial data. | |
| “If this is the case, a copy of data would be sent to the criminals as it was relayed to the company’s main IT infrastructure. This kind of attack could also have affected the app if they use common systems.” | “If this is the case, a copy of data would be sent to the criminals as it was relayed to the company’s main IT infrastructure. This kind of attack could also have affected the app if they use common systems.” |
| The National Crime Agency said it is investigating the breach. A spokesman for the Information Commissioner’s Office said it would also be making inquiries about the data theft. | The National Crime Agency said it is investigating the breach. A spokesman for the Information Commissioner’s Office said it would also be making inquiries about the data theft. |
| “Perhaps most significantly, this is one of the first major breaches since GDPR came into effect in May,” Walters said. “It appears that the company notified the Information Commissioner’s Office and customers within the GDPR’s mandatory 72 hours but the breach will now be investigated and the company could be penalised if it failed to take all the necessary measures to protect customer data.” | |
| Full details on precisely how this attack happened, and any possible punitive actions including fines for BA, may only be revealed months down the line. | Full details on precisely how this attack happened, and any possible punitive actions including fines for BA, may only be revealed months down the line. |
| In the meantime, experts say the consequences for those affected by the theft are likely to roll out over time. | |
| “Once hackers have hold of high-value data like card details, the market in criminal networks for reselling is huge, meaning that we may not see the effects of this theft immediately until a buyer acts,” Leigh Anne Galloway, the cyber security resilience lead at Positive Technologies, said. “The best thing to do for anyone who thinks their details may have been involved, or who has been told so by BA, should keep an eye on their transactions. Consider cancelling the affected bank card and request a replacement for peace of mind.” | |
| British Airways | British Airways |
| Data protection | Data protection |
| Cybercrime | Cybercrime |
| Hacking | Hacking |
| Airline industry | Airline industry |
| Travel & leisure | Travel & leisure |
| analysis | analysis |
| Share on Facebook | Share on Facebook |
| Share on Twitter | Share on Twitter |
| Share via Email | Share via Email |
| Share on LinkedIn | Share on LinkedIn |
| Share on Pinterest | Share on Pinterest |
| Share on Google+ | Share on Google+ |
| Share on WhatsApp | Share on WhatsApp |
| Share on Messenger | Share on Messenger |
| Reuse this content | Reuse this content |