- A sophisticated cyberattack hit British Airways between August 21 and September 5, 2018.
- Only 22 lines of JavaScript were enough to copy payment data from 380,000 customers.
- Credentials found unencrypted in a plain text file: a critical oversight that changed the story.
- The attack ran right under everybody's nose without disrupting a single payment.
It happened between August 21 and September 5, 2018. During those 16 days, a sophisticated cyberattack hit the British Airways website and app.
The breach
These credentials were just sitting in a file: unencrypted, in plain text. This is a critical security oversight. It's also a game changer in this story.
It was happening right under everybody's nose without any disruption of the payment process. Customers completed their transactions. Orders were processed. Everything looked normal, on both sides.
The mechanics
One tiny weak spot in one of those third-party scripts can cause a big security headache. The attackers didn't break in through the front door. They slipped in through a side entrance that nobody was watching.
What is okay today, might be a security incident tomorrow. The script that worked fine during testing can be manipulated at the source. The moment you allow scripts to load from external servers, you lose control in the user's browser.
The aftermath
The breach was discovered and reported to the ICO. Based on the penalty notice, a reconstructed timeline, and public sources, this is the story of how it happened, written for a technical audience that's seen too many oversimplified takes.
This is a short highlight. The full, immersive piece — timeline, visuals and sources — is published at baways.com.