10 ms·
British Airways faces record £183M fine for data breach
- dijit 7y agoThis is a death knell for BA, my friends father is a high level manager and if he’s to be believed they are running on major thin margins. Mostly due to compensating employees fairly in the 90’s-early-2000’s. Now they’re desperately trying to remove those compensation packages. Although it could just be cost aversion masquerading as a hard requirement.
- daveoflynn 7y ago£183m is about 10% of the profit BA made in FY 2018 before exceptional items: > Despite these challenges, our revenues have held up, increasing 5.7 per cent versus last year. ... we achieved an operating profit of £1,952 million before exceptional items and a return on invested capital (RoIC) of 17.3 per cent source: page 18 of https://www.iairgroup.com/~/media/Files/I/IAG/documents/annual-report-and-accounts-2018-interactive.pdf https://www.iairgroup.com/~/media/Files/I/IAG/documents/annu... I think BA (and their parent IAG) are going to be just fine.
- isostatic 7y agoBA has becoming a low cost carrier over the last 10-15 years and make a large profit from it. They're trading on their past glories and failing to innovate. Last time I traveled BA in first it was shocking, rude crew, dirty seats. FinnAir in Business on the other had is a joy to behold. I used to hit 2500 tier points a year on BA metal, I barely make 300 now, just occasional short flights in europe, but they've doubled-down on the 737 max, so I guess that will end soon too.
- magduf 7y ago>Last time I traveled BA in first it was shocking, rude crew, dirty seats. FinnAir in Business on the other had is a joy to behold. It seems like the American and European airlines are all going down the tubes, unless you shell out for business class on certain ones. The Asian airlines are the best ones these days; you don't have to pay extra for a first-class or business-class ticket to get superb service and cleanliness there.
- magduf 7y agoDon't forget, this is the same company (IAG, their parent company actually) that just placed an order for 200 Boeing 737MAX aircraft. I'm going to stay far away from this company and its planes.
- jeffail 7y ago"amounts to 1.5% of its worldwide turnover in 2017" I imagine that's a significant sum but I'm struggling to get my head around it. If so then good for the ICO I suppose. I remember reading endless comments a few years back speculating GDPR would never have any bite.
- sneak 7y agoToo bad this will all go to the state and not to any of the people who were actually damaged in the breach. :/
- aw3c2 7y agoThe state is made up by the people it represents so by this, society benefits as whole.
- sneak 7y agoNot only is this false in the national sense, as the machinery and personnel of the state are not coterminous with those they rule over, but it is also false in this specific sense, as many of the people who were harmed by this breach (such as myself) were not involved or are not permitted to be involved with the regulatory body that is assessing this fine. Many people who are not British subjects are customers of BA. The ICO does not represent me, yet somehow they are getting paid for the misuse of my data. It’s nice work if you can get it.
- jamieap 7y agoRemind us how the investigation and prosecution of this fine was funded?
- Angostura 7y ago> Not only is this false in the national sense, as the machinery and personnel of the state are not coterminous with those they rule over ... I'll bite - explain? > The ICO does not represent me, yet somehow they are getting paid for the misuse of my data. It’s nice work if you can get it. The funds aren't going to the ICO specifically, any more than they are specifically paying for my mother's NHS kidney operation.
- sneak 7y agoFine: The UK Treasury/Government does not represent or benefit me, as I am not a crown subject.
- sbhn 7y agoSo who gets the money? The people who had there data stolen? Who gets the money are the people who create laws. The more crimes commited, the safer there jobs are. The people who had there data stolen, are now on a register sold to the insurance industry, and the insurance industry decides they are a greater risk to insure, so the costs to the consumer go up. Strange how crime really drives the economy.
- dtf 7y agoThe Treasury. Fines are sent to the Consolidated Fund (the government's general account at the Bank of England).
- graphene 7y agoFrom the article: Where does the money go? The penalty is divided up between the other European data authorities, while the money that comes to the ICO goes directly to the Treasury. So it seems most of it will go to other European data authorities.
- dtf 7y agoAh thanks, I missed that. It usually all goes to HM Treasury but this is a joint operation between multiple EU supervisory authorities. "ICO has been investigating this case as lead supervisory authority on behalf of other EU Member State data protection authorities. It has also liaised with other regulators. Under the GDPR ‘one stop shop’ provisions the data protection authorities in the EU whose residents have been affected will also have the chance to comment on the ICO’s findings." https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/ico-announces-intention-to-fine-british-airways/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...
- mirekrusin 7y agoYeah, people got "we're sorry" paragraph and that's about it. They won't get "we're sorry" paragraph when their bank accounts will get wiped though.
- 7y ago
- planetjones 7y agoSeems very just. BA clearly had no controls to understand the code running in production was the code they had deployed. I hope this serves as a wake up call to other companies who have a blatant negligence for infosec.
- buro9 7y ago> clearly had no controls to understand the code running in production This applies to everyone who has advertising or third party anything on their page, no?
- raesene9 7y agoYep pretty much :) Actually it's worse than that. Even without 3rd party JS, most major websites these days run on large piles of open source libraries that have never been security reviewed (e.g. code from npm, rubygems, PyPi, NuGet) and attackers are increasingly targeting those underlying libraries for compromise...
- jeltz 7y agoBasically, yeah. You can specify a hash for third party JS and audit it at that version and you can sandbox JS in iframes, but most people do not do that.
- isostatic 7y agoIf they choose to import some code from elsewhere sure. They could run their own advert by hosting "advert.jpg" on their server and wrapping it in an anchor tag. BA however are a company selling their own product, no need for them to have adverts. If they want to dilute their product with adverts then they take the risk of fines (as well as losing custom)
- ginko 7y agoWhy does an airline even need to show advertising on their page in the first place. You'd think they would be most concerned about selling their own product.
- topogios 7y ago"The information included names, email addresses, credit card information such as credit card numbers, expiration dates and the three-digit CVV code found on the back of credit cards, although BA has said it did not store CVV numbers." Is it standard for airlines to handle storing payment card details themselves and hence having to be PCI certified instead of delegating to a PSP?
- robjan 7y agoSomeone injected Javascript into their pages which collected this information. But, yes, it's standard practise for airlines to store card information (excluding the 3/4 digit code) in the customers' PNR (Passenger Name Record) in the airline's GDS (Global Distribution System). The details are on this page: https://servicehub.amadeus.com/c/portal/view-solution/965353/en_US/ticketing-and-fare-elements-form-of-payment-fp- https://servicehub.amadeus.com/c/portal/view-solution/965353...
- namdnay 7y agoJust a quick clarification, in the case of an airline website, the PNR will not be created through the GDS (too expensive), it will be created directly in the PSS (usually managed by the same company)
- robjan 7y agoThink it depends on the airline and whether they allow agent bookings. Last I knew, BA.com created them on 1A but that may have changed with NDC.
- namdnay 7y agoFor web they create them on 1A, but directly in 1A PSS, not going through 1A GDS (and therefore not paying the GDS fee, just a PSS fee). This is the case for all direct channels (websites or airline call centers) of all airlines
- victorvation 7y ago
- jrpt 7y agoFor those who are wondering what happened, British Airway’s website had malicious JavaScript included in some files they were using. Compromised third party libraries (in this case, the Modernizr library) was the attack vector. The malware would take sensitive data off the webpage and send it back to the hackers surreptitiously. Most sites still would have no idea if this were to happen to them today. That’s why I’ve developed Enchanted Security (https://enchantedsecurity.com/ https://enchantedsecurity.com/) - a virtual content security policy that tracks the network requests and even blocks malicious ones. It’s like a firewall but running on your users’ browsers. This would’ve prevented what happened to British Airways. Get in touch if you’re interested in learning more.
- leejo 7y agoHere's a breakdown of the attack: https://www.riskiq.com/blog/labs/magecart-british-airways-breach/ https://www.riskiq.com/blog/labs/magecart-british-airways-br...
- Anthony-G 7y agoThanks. That was really interesting. I concluded from the article that as a noScript/uBlock user, I wouldn’t have been protected from this attack. In general, I’ve noticed that for many ecommerce sites, I have to enable some third-party script and refresh the page a number of times. Not only do you have to guess which third-party script is the one providing the functionality to complete the transaction but it’s an iterative process where the loaded third-party scripts have a further dependency on yet another third-party. Even as a technically aware user, I don’t have time to go examining whois records and TLS certificates to attempt to determine if baways.com (or baplc.com or bacdn) are genuine. In any case, I doubt either of these extensions would protect use from “trusted” JavaScript from making a POST request to a third-party site. (BTW, I’m not arguing against the use of these browser extension as they do a great job of protecting against other threats). I’m glad the ICO fined BA a non-trivial amount because users/customers shouldn’t have to be constantly on the alert, exercising a high degree of vigilance – and staying up-to-date with ever-changing and increasingly complex stacks of web technology.
- 7y ago
- jajag 7y agoStatement on the Information Commissioner's website: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/ico-announces-intention-to-fine-british-airways/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...
- Anthony-G 7y agoThe statement shows that the ICO investigated this data breach on behalf of other data protection regulators of other EU states. As an Irish citizen, I wish our Data Protection Commission was as serious about protecting the personal data of EU citizens.
- biddlesby 7y agoDo the regulators take into account whether the firm is actually at fault? Without considering what happened in this specific scenario, surely there are cases where companies take the utmost care, follow standard security principles and still get hacked; or the issue was not with the company operating the website but rather with, say, a hardware manufacturer?
- dmitriid 7y agoYes, the regulators do take all things into consideration. A fine is the final measure. In case of BA they ran third-party scripts on account and payment pages without users’ consent, did bot remove them even after being alerted to it, and then succumbing to a data breach because of that.
- dalbasal 7y agoThey do in some form. Largely though, "regulator" action tends to be outcome based. Relying on "standards" can be difficult. In some caes, standards exist and ignoring them can point to negligence. Conversely though, standards don't exist for a lot of things and when they do, they're not a full solution. IE, it's possible to follow "standard security practices," while still being insecure. If regulators make that a "get-out"... you may as well just have legislation instead of a regulator. In recent times, regulators and legislators don't understand the problems (maybe no one does) sufficiently to be specific with rules. They demand general things, outcomes (you will not lose data) and general operating principles (you will secure your users' data , have good policies, and enforce them). Both data protection (eg gdpr) and anti money laundering rules are examples of recent areas that work this way. If a bank's customer has been depositing stolen money, financing terrorism or something... the bank is at risk. Their policies will be examined and circumstances do get taken into account, but the "standards" they're judged against aren't absolute and standards compliance doesn't totally protect them. OTOH, if they don't adhere to their own policies or the policies are bad... it is enough to get them in trouble. Lawyers, btw, hate this emerging system. In short, modern "regulator enforcement" is a lot less legible & "letter of the law" oriented than legal environments that we are going used to.
- 7y ago
- K0nserv 7y ago> At the time, BA said hackers had carried out a "sophisticated, malicious criminal attack" on its website. Compromising a single JS resource that was being carelessly loaded on a payment page doesn’t qualify as sophisticated in my mind. It might not be uncommon in the industry, but tools like SRI and CSP stop these attacks dead in their tracks. I believe we are about one huge attack[0] of this kind away from realising how dire the situation truly is. As a victim of the earlier Ticketmaster attack I’m curious as to if the ICO is investigating that too. 0: https://hugotunius.se/2018/11/29/how-to-hack-half-the-web.html https://hugotunius.se/2018/11/29/how-to-hack-half-the-web.ht...
- planetjones 7y agoExactly it was a crude and unsophisticated attack. I am pleased the ICO looked at the facts, not the spin and recognised the negligence of BA.
- barking 7y agoIt seems the ICO website, itself was infected in a similar way last year with a crypto miner. https://scotthelme.co.uk/protect-site-from-cryptojacking-csp-sri/ https://scotthelme.co.uk/protect-site-from-cryptojacking-csp...
- robocat 7y agoBut they most they can fine themselves is 4% of their turnover.
- davegardner 7y agoI suspect your comment is at least partly a joke, however the actual maximum fine possible is 4% or €20 million, whichever is higher.
- CuriousSkeptic 7y agoHow would SRI and CSP help in this case? Wasn’t the compromised script served from their own infrastructure? And if hackers had access to that, why wouldn’t they they be able to change the SRI and CSP too?
- alkonaut 7y agoExcellent. Now I wish they pick another big corporation (just pick one) and hand them a similar fine for using a standard GDPR opt-in-by-default popup. They need to make it clear through action, not just vague wording, that having a default of allowing all tracking is not ok. Pop ups should say “hi and welcome to site X. Click the yelliow button to enter with tracking/personalization and the blue button to enter without”.
- golemiprague 7y agoWhy would they give you a way to enter without? if you don't want to provide your info don't enter. Are you going to pay them for the work they have done? clean their house? why do you expect them to give you anything for free? Tracking the info is the cost, you don't like don't buy and don't pay.
- Jnr 7y agoThe company I work for explains it to our customers that we can't enable any tracking cookies, analytics, external chat scripts and other external scripts unless visitor opts in. I explain that it is against the law and they back down. Sadly not many people in the industry realize it and they keep doing whatever they were doing for years.
- rlpb 7y agoOriginal source: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/ico-announces-intention-to-fine-british-airways/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...
- xhgdvjky 7y agoThis may be the beginning of the end of hiring front end devs in house. Suddenly they are a serious liability... much nicer if you can pass on the fine to a third party!
- barking 7y agoI'd say it's likely to be a game changer when it comes to skimping on IT in general, whether in-house or outsourced. It's good news.
- kkm 7y agoWebsites need to really up their game, specially given the amount of third-parties they are using. I've tried highlighting similar issues in the past, where even if there is no active breach, but they are leaking sensitive data to multiple third-parties when it's not needed in the first place. https://dev.to/konarkmodi/watching-them-watching-us-how-websites-are-leaking-sensitive-data-to-third-parties-1nn3 https://dev.to/konarkmodi/watching-them-watching-us-how-webs... https://news.ycombinator.com/item?id=16516687 https://news.ycombinator.com/item?id=16516687
- simion314 7y agoIs good that we see on the font page of HN more GDPR fines for non US companies because I seen a lot of US users accusing that only US companies are targeted(there are other non US examples but those did not appeared or stayed on the first page here on HN ).
- pjc50 7y agoYes, there was always that weird nationalist claim that GDPR was just a protectionist measure rather than a sincere attempt to achieve its stated aims.
- OliverJones 7y agoUK's ICO and other data security enforcers are acting. That's good. They're changing companies' calculus about putting resources into infosec. That's even better. The public and press perceive that "justice is served," so we're tempted to think the problem is solved. I don't think that's helpful. These fines don't address root causes of the problem. They don't make our systems more resilient. They're drawing a significant amount of money from the system and transferring it to their governments' general accounts. Is that the best use of that money? Should some of that money be used to help address infosec problems? To fund training for citizens, legislators, and governments? To step up law enforcement efforts against cybercreeps? To publicly fund independent security researchers (white-hat hackers) to help detect this stuff and nip it in the bud? To help subsidize the significant expense of comprehensive infosec audits for municipal governments, ngos, and small firms? Here in USA, the National Security Agency has, by hoarding zero-day exploits and inadequately protecting them, done major infosec damage to civil institutions worldwide (UK's NHS, the Baltimore city government, you name it). I suspect similar things have happened in other governments. To what extent is it their responsibility to help clean up the mess? Can other governments use their resources to backfill where the US government can't or won't act? Do governments now join identity thieves as enemies of people doing infosec? That cannot be good. We have to get this right and we can't do it if we're fighting each other rather than the criminals causing the trouble.
- M2Ys4U 7y ago>They're drawing a significant amount of money from the system and transferring it to their governments' general accounts. Is that the best use of that money? Should some of that money be used to help address infosec problems? Well the point of these fines is to say to organisations "put your money into infosec, or when you have a breach it'll probably be your fault and we'll take that money as a punishment". >Should some of that money be used to help address infosec problems? To fund training for citizens, legislators, and governments? To step up law enforcement efforts against cybercreeps? To publicly fund independent security researchers (white-hat hackers) to help detect this stuff and nip it in the bud? To help subsidize the significant expense of comprehensive infosec audits for municipal governments, ngos, and small firms? The NCSC[0], GCHQ's defensive side, publishes advice for the public, companies, charities, schools, government departments etc. [0] https://www.ncsc.gov.uk/ https://www.ncsc.gov.uk/
- EnderMB 7y agoI'm glad to see a solid fine given for a data breach. I've worked on projects in this sector before, and it's a common story to others - client cuts cost as much as possible, until the risk of an inferior product has grown too high to handle. It's a race to the bottom, and security rarely comes into consideration outside of a basic pen test being mentioned (if it happens). Still, I'm quite annoyed at the lack of follow-up against what is blatant bullshit from BA. When your business is so heavily reliant on taking payments online, their security procedures should be airtight. I can understand that it's quite a clever hack, but it's security 101 to know what third-party code is doing on your server. The fine is good, but it would be nice to enforce rules where a company caught in a data breach has to accept liability and not contest the severity.
- JustSomeNobody 7y agoI think what happened to D-Link should be standard. They have to have 10 years of independent security audits.
- Bombthecat 7y agoThe question is, what kind of people do those kind of companies look for / take. Are they looking and taking "just here to mark a check box, I don't care if it works or is true... Or do they take people who will tell them (and they react) what is wrong? More often then not you see something like this: encryption too weak: me guys, this is too weak! Answer : it's good enough for this scenario in this network. And they proceed to mark the box... Encryption existent..
- EnderMB 7y agoI like this idea, although I would also like to see a push towards the improvement of their tech team. IMO, these issues are rarely down to the people in the trenches, and more to do with a lack of budget or care from management. I would push for independent auditing, with a view towards the auditors ensuring that the team in place is capable of continuing this work.
- martinald 7y ago
- TomAnthony 7y agoIs there a good reason for them not to launch a bug bounty program? The cost of doing so would be significantly cheaper than any future fines, and would reduce the chances of future breaches.
- jfk13 7y agoJust FTR, note that BA might appeal against this, so it may be subject to revision before it's all over... “BA has 28 days to appeal. Willie Walsh, chief executive of IAG, said British Airways would be making representations to the ICO. "We intend to take all appropriate steps to defend the airline's position vigorously, including making any necessary appeals," he said.”
- olliej 7y agoSo this is ~$366 per person whose data was compromised. That seems fairly cheap all things considered. It's a far sight better than the "credit protection" they normally provide (from our point of view, rather than the people who are used to not having any penalties for abusing their customers). Remembering of course that the typical cost to companies making when they settle with "credit protection" is much lower than the already low $30 individuals would have to pay. I'm also tired of newspapers parroting press releases that say things like "sophisticated, malicious criminal attack". Just like a few years ago every publicly exposed+default password service was compromised by "Nation state attackers", and before then "Advanced Persistent Threats". If you make a claim like this, you should be required to provide the full details of the attack: - what level of employee account was compromised, and if none was needed, why not? Otherwise, did the targeted employee need the level of access that the attackers used? If not, why did they have it? Simply being a C-level executive does not imply requiring access. - Did it make use of any software exploits? If it did, were those exploits fixed in the release versions? If those exploits were fix in released software, why was that out of date software being used? - Is your company using established best practices: 2FA for all accounts, TLS for all networking, service isolation. - Did the compromise come about due to loading content from a third party? If so, how was that code authenticated (multiple browsers support SRI)? Was that code used to support the site functionality, or was it for tracking or advertising? This seems like a perfectly reasonable bare minimum if you want to support a claim that the compromise was unavoidable.