British Airways Breach: How Card Details Were Skimmed

Customers typed their card details into the real British Airways website. A few lines of changed code sent a copy to someone else. That is how card skimming works online.

By Siddharth ShankarUpdated October 11, 2026

Online card theft often feels invisible. There is no suspicious email and no strange link. The page looks right, the payment goes through and the problem appears later on a statement. The 2018 British Airways incident is the best-known UK example.

What happened

The ICO's penalty notice is dated October 16, 2020. It sets a penalty of £20 million, reduced from the £183.39 million proposed in a notice of intent on July 4, 2019. The notice says about 429,612 data subjects were affected. Of those, 244,000 had their name, address, card number and CVV exposed; 77,000 had card number and CVV only; and 108,000 had card number only.

The ICO also reports that employee and administrator usernames and passwords were exposed, along with usernames and PINs for up to 612 Executive Club accounts. The attack ran from June 22 to September 5, 2018. British Airways notified the ICO on September 6, 2018.

How it worked

The ICO found that initial access used login credentials belonging to an employee of a third-party cargo provider, through British Airways' Citrix gateway. That account had no multi-factor authentication. Inside the network, a plain-text file contained a domain administrator username and password.

Website code was then modified so that customer card data was copied to a lookalike domain, BAways.com. The copying ran for 15 days, from August 21 to September 5, 2018. Separately, the notice found that log files had stored card details in plain text, including CVVs, since December 2015.

What was exposed

Card data typed into the checkout was copied as customers entered it. For some people the exposed set included a CVV, which is the three-digit security code on the back of a card and is meant not to be stored after a payment is approved.

The incident shows how a single unprotected supplier account can lead to the customer-facing website. Customers never interacted with the cargo provider, yet its login was the way in.

How it ended

The £20 million penalty was well below the originally proposed figure. As with most regulatory fines, the money goes to the government, not to the people affected. Customers could dispute fraudulent charges with their card issuers, but the notice is not a compensation order.

Key facts at a glance

• Penalty: £20 million, down from a proposed £183.39 million
• Penalty notice date: October 16, 2020
• People affected: about 429,612
• Attack period: June 22 to September 5, 2018
• Card copying window: 15 days, August 21 to September 5, 2018
• Entry point: a third-party provider's login with no multi-factor authentication

What to do after a card breach

What the notice does not say

The notice does not tell individuals whether they should expect compensation. It also does not name who carried out the attack. For a very different UK breach with a smaller fine, see the 23andMe credential stuffing fine.

Why this case matters

The British Airways case shows two separate failures that combined. The first was access: a supplier's login without multi-factor authentication. The second was storage: card details, including security codes, written to log files in plain text for years. Either one alone would have been a lesson. Together they gave the attacker both a way in and something worth taking.

For customers, the practical protection is on the payment side. Virtual cards, single-use numbers and prompt statement checks reduce what a skimmer can do with a stolen number.

To turn the lesson into action, our guides explain what each type of breached data means, what to do after your email appears in a breach and how to tell a real breach notice from a phishing message. You can also try our free email exposure check.