Safeguard
Vulnerability Analysis•

British Airways (2018): A Magecart Web Skimming Attack

A factual retrospective on the 2018 British Airways breach, in which attackers injected a JavaScript card-skimming script into the airline's payment page, compromising roughly 380,000 transactions.

Safeguard Research Team
2 min read

British Airways (2018): A Magecart Web Skimming Attack

Summary

In September 2018, British Airways disclosed that attackers had compromised its website and mobile app, injecting malicious JavaScript that skimmed customer payment card details in real time during checkout. Roughly 380,000 transactions were affected, and the UK Information Commissioner's Office (ICO) later issued a substantial fine under GDPR.

Technical Root Cause

The attack, attributed to a threat cluster tracked under the "Magecart" umbrella, involved compromising a script (reportedly a modified Modernizr JavaScript library) loaded by the British Airways payment page. The injected code captured form field data as customers typed payment details and exfiltrated it to an attacker-controlled domain designed to resemble a legitimate British Airways asset domain, making the traffic harder to spot. This class of attack maps to CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) — trusting a third-party or modifiable script in a payment-sensitive context.

Why It Mattered

Unlike a server-side database breach, this attack skimmed data client-side, directly from the browser, meaning it could evade security controls focused on backend systems and databases entirely. It highlighted those risks introduced by third-party and dynamically-loaded JavaScript in checkout flows, which have direct access to sensitive form input.

OWASP / CWE Mapping

  • CWE-829: Inclusion of Functionality from Untrusted Control Sphere
  • OWASP A08:2021: Software and Data Integrity Failures (unverified script content)

Lasting Impact

The British Airways incident, alongside similar Magecart attacks on other retailers, drove increased adoption of Content Security Policy (CSP), Subresource Integrity (SRI) for third-party scripts, and dedicated client-side (browser-side) security monitoring tools distinct from traditional server-side application security testing.

How Safeguard Helps

Safeguard's supply chain risk analysis extends to third-party script and dependency risk, flagging unverified or unpinned external script sources loaded in security-sensitive contexts like payment pages.

References

british-airwaysmagecartweb-skimmingcwe-829third-party-scripts2018
Back to all articles

Related articles in Vulnerability Analysis

Vulnerability Analysis

Uber (2016): Hardcoded Credentials in a Private Repository

A factual retrospective on the 2016 Uber breach, where attackers used credentials found in a private GitHub repository to access an AWS account holding rider and driver data, and how it was later concealed.

September 17, 2026Read
Vulnerability Analysis

Capital One (2019): An SSRF Misconfiguration Breach in the Cloud

A factual retrospective on the 2019 Capital One breach, in which a server-side request forgery flaw against a misconfigured WAF allowed access to AWS metadata credentials and over 100 million customer records.

September 17, 2026Read
Vulnerability Analysis

MOVEit Transfer (CVE-2023-34362): A Mass Exploitation Data-Theft Campaign

A factual look at the 2023 Cl0p ransomware group campaign exploiting a SQL injection vulnerability in Progress Software MOVEit Transfer to steal data from hundreds of organizations.

September 17, 2026Read

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

Book a demoGet started

No sales call required, even your agent can complete the purchase over MCP.