British Airways Breach Linked to Ticketmaster Breach Attackers

The British Airways data breach revealed last week, which exposed the personal data of approximately 380,000 customers, was committed by Magecart, the same group responsible for Ticketmaster's June breach that affected 40,000 customers, according to researchers at RiskIQ.

Researchers suspected Magecart because they noticed that the airline's reports about the attack indicated that customers' credit card data and personal information had been stolen directly from payment forms via the website and mobile app. 

Magecart uses "digital skimmers," which inject scripts to steal payment card information from payment forms, much like a physical credit card skimmer. They used this technology recently in the Ticketmaster compromise.

The attackers set up a highly customized infrastructure for the campaign against British Airways, which indicated to RiskIQ researchers that Magecart may have had extensive access to the British Airways servers, and long before the actual data theft began. "While we can never know how much reach the attackers had on the British Airways servers, the fact that they were able to modify a resource for the site tells us the access was substantial, and the fact they likely had access long before the attack even started is a stark reminder about the vulnerability of web-facing assets.

Read more here.