HackingTransportation & LogisticsTransportationVulnerability ExploitCapture Stored DataData ExfiltratedCustomer Data InvolvedRansom DemandedPIIIdentity (basic)Financial accountFinancial credentialsHighContained

BRITISH AIRWAYS PLC

bd_3db3cca5ab4ee60d · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 5, 2018

Filed

Nov 21, 2018

To disclose

11 weeks

Affected · nationwide

537,1071,588 in this filing

Linked

6 filings

Confidence

69%

Full breach record for BRITISH AIRWAYS PLC →2 incidents on file

British Airways PLC notified Washington AG of a cyberattack where malicious code on its website and mobile app redirected customer data (names, billing addresses, payment card numbers, CVVs) to a third-party domain. The incident occurred from Aug 21 to Sep 5, 2018, and was discovered on Sep 5, 2018. Approximately 537,107 customers globally were affected, including 1,588 Washington residents. BA engaged forensic investigators, removed the code, notified customers, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 15 days

discovery → filing · 11 weeks / 77 days

Aug 21, 2018

Begins

Sep 5, 2018

Discovered

Nov 21, 2018

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_5ff5f9a096a206be2018-11-21Verified
California State AGbd_89733c53fc087c112018-11-21Verified
Oregon State AGbd_b36bde0aceae97312018-11-21Verified
New Hampshire State AGbd_8bedfc3683b2f1ca2018-11-26 · +5dVerified

Show 1 more filing ↓up to 26d gap

Montana State AGbd_357c3adfdee25fcb2018-10-26 · +26dCandidate

Name: Norton Rose Fulbright US LLP
norm: norton rose fulbright us

Name: BRITISH AIRWAYS PLC
norm: british airways-gb
Industry: Transportation & Logisticsllm

Discovered: Sep 5, 2018
Breach occurred: Aug 21, 2018 – Sep 5, 2018
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 7, 2018
Affected individuals: 537,107state + nationwide
Data types: PIIIdentity (basic)Financial accountFinancial credentials
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1074 Data Staged
Threat actor: ExternalFinancial
Regulator citations: Notified the United Kingdom’s Information Commissioner’s OfficeNotified UK law enforcementCooperating fully with their enquiries
Initial access: exploit_public_facing

During the incident: Removed the malicious code from its website and mobile app
Stopped the data from being redirected to baways.com
Engaged the assistance of cyber forensic investigators
Made a statement on its website
Notified potentially affected customers around the world of the breach by email
Notified affected Washington residents via email
Provided notice to major media outlets
Posted a notice and additional information for affected individuals about the incident on its website
Offering credit monitoring services to Washington residents upon request
Committed to reimbursing any financial losses suffered by its customers
Notified the United Kingdom’s Information Commissioner’s Office, UK law enforcement and other UK regulators
Changes made: Conducting a thorough review of its security measures, internal controls, and safeguards
Making changes to help prevent a similar incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(77 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGOct 26 · first

Massachusetts State AG+26d

California State AG+26d

Oregon State AG+26d

Washington State AG+26d · this page

New Hampshire State AG+31d

Pattern: first filing Oct 26 (MT), last Nov 26 (NH) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10600.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 21, 2018
Raw hash: b32f5ebfe78651bcf7bf08e99c5ce9b265c56fd99f2216b420bbfad3458636a9

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityNorton Rose Fulbright US LLP

Victim entityBRITISH AIRWAYS PLC

Incidentdiscovered Sep 5, 2018

Stated responseRemoved the malicious code from its website and mobile app

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com