British Airways was fined £20M after 22 lines of code stole 400,000 customers' details

On 6 September 2018 British Airways disclosed that its website and mobile app had been compromised. Attackers had injected 22 lines of JavaScript — a technique attributed to the Magecart group — that diverted customers' payment card details, names, addresses and CVV codes to an attacker-controlled server while bookings appeared to proceed normally. The script was active from 21 August to 5 September; by the time BA removed it, the personal data of approximately 429,612 people had been exposed.

The ICO's investigation found the breach was entirely preventable. BA had failed to enable multi-factor authentication on a privileged administrator account, had left a testing feature running that logged payment card details in plaintext, and had done insufficient security testing on its own website. Attackers entered through compromised credentials for a third-party cargo handler's account, escalated privileges by finding a plaintext password file, and then modified the payment page code.

The ICO initially intended to fine BA £183.39 million — 1.5% of the airline's 2017 turnover, and the largest proposed GDPR penalty at the time. In October 2020 the final fine was reduced to £20 million, with the regulator citing the economic impact of Covid-19 and BA's mitigating steps. Even reduced, it was the largest ICO penalty ever issued.