British Airways Hacked

[kelemvor]

If you bought tickets on the British Airways website or mobile phone app between August 21 2018 and September 5 2018 you may want to get a replacement credit card ordered.

British Airways site had credit card skimming code injected

The 22 lines of code are targeted to export the data entered in the BA website's payment form to the malicious server when the "submit" button was clicked by a customer, with the data being sent as a JSON object. As a result, the transaction would go through for the customer without any errors, while the attackers received a full copy of the customer's payment information despite the payment apparently being over a secure session. The attackers also added a "touchend" callback to the script, which made the attack functional for users of BA's mobile app—which called the same, modified script.