HackingOtherStolen CredentialsPhishingData ExfiltratedCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Financial accountFinancial credentialsHighContained

BRITISH AIRWAYS PLC

bd_8bedfc3683b2f1ca · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 5, 2018

Filed

Nov 26, 2018

To disclose

12 weeks

Affected · nationwide

537,107228 in this filing

Linked

6 filings

Confidence

65%

Full breach record for BRITISH AIRWAYS PLC →2 incidents on file

British Airways Plc notified New Hampshire AG of a security incident discovered Sept 5, 2018, involving unauthorized access to payment card and personal data. Malicious code redirected customer data between Aug 21 and Sept 5, 2018. Approximately 537,107 customers globally affected, including 228 NH residents. BA engaged forensic investigators, removed malware, notified customers, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 15 days

discovery → filing · 12 weeks / 82 days

Aug 21, 2018

Begins

Sep 5, 2018

Discovered

Nov 26, 2018

Filed

vs. sector median

+4 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_3db3cca5ab4ee60d2018-11-21 · +5dVerified
Massachusetts State AGbd_5ff5f9a096a206be2018-11-21 · +5dVerified
California State AGbd_89733c53fc087c112018-11-21 · +5dVerified
Oregon State AGbd_b36bde0aceae97312018-11-21 · +5dVerified

Show 1 more filing ↓up to 31d gap

Montana State AGbd_357c3adfdee25fcb2018-10-26 · +31dCandidate

Name: Norton Rose Fulbright US LLP
norm: norton rose fulbright us

Name: BRITISH AIRWAYS PLC
norm: british airways-gb
Industry: Otherllm

Discovered: Sep 5, 2018
Breach occurred: Aug 21, 2018 – Sep 5, 2018
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 7, 2018
Affected individuals: 537,107state + nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1074 Data StagedT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the United Kingdom’s Information Commissioner’s OfficeNotified UK law enforcementNotified other UK regulatorsCooperating fully with their enquiries
Initial access: exploit_public_facing

During the incident: Immediately removed the malicious code from its website and mobile app
Stopped the data from being redirected to baways.com
Engaged the assistance of cyber forensic investigators
Made a statement on its website
Notified potentially affected customers around the world of the breach by email
Notified affected New Hampshire residents via email
Provided notice to major media outlets
Posted a notice and additional information for affected individuals on its website
Offering credit monitoring services to New Hampshire residents upon request
Committed to reimbursing any financial losses suffered by its customers
Notified the United Kingdom’s Information Commissioner’s Office, UK law enforcement and other UK regulators
Changes made: Conducting a thorough review of its security measures, internal controls, and safeguards
Making changes to help prevent a similar incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(82 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGOct 26 · first

Washington State AG+26d

Massachusetts State AG+26d

California State AG+26d

Oregon State AG+26d

New Hampshire State AG+31d · this page

Pattern: first filing Oct 26 (MT), last Nov 26 (NH) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/british-airways-20181126.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 26, 2018
Raw hash: 39e14506755edc4844bc2e96e28fffe51c7b82d7f283b238233dbeb2206c3ef6

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityNorton Rose Fulbright US LLP

Victim entityBRITISH AIRWAYS PLC

Incidentdiscovered Sep 5, 2018

Stated responseImmediately removed the malicious code from its website and mobile app

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov