[BreachExchange] British Airways Breach Linked to Ticketmaster Breach Attackers

[Destry Winant]

https://www.darkreading.com/attacks-breaches/british-airways-breach-linked-to-ticketmaster-breach-attackers/d/d-id/1332783

Magecart attackers hit airline with the same "digital skimmers" they
used on the entertainment company in June, researchers say.

The British Airways data breach revealed last week, which exposed the
personal data of approximately 380,000 customers, was committed by
Magecart, the same group responsible for Ticketmaster's June breach
that affected 40,000 customers, according to researchers at RiskIQ.

Researchers suspected Magecart because they noticed that the airline's
reports about the attack indicated that customers' credit card data
and personal information had been stolen directly from payment forms
via the website and mobile app.

Magecart uses "digital skimmers," which inject scripts to steal
payment card information from payment forms, much like a physical
credit card skimmer. They used this technology recently in the
Ticketmaster compromise.

The attackers set up a highly customized infrastructure for the
campaign against British Airways, which indicated to RiskIQ
researchers that Magecart may have had extensive access to the British
Airways servers, and long before the actual data theft began. "While
we can never know how much reach the attackers had on the British
Airways servers, the fact that they were able to modify a resource for
the site tells us the access was substantial, and the fact they likely
had access long before the attack even started is a stark reminder
about the vulnerability of web-facing assets.