Revealed: The shadowy hacker group blamed for attack on British Airways

Hannah Boland
Updated
A group called Magecart, which is believed to have links to Romania and Lithuania, may have been responsible - PA
A group called Magecart, which is believed to have links to Romania and Lithuania, may have been responsible - PA

Hackers who masterminded a major security breach of Ticketmaster are being blamed for an attack on British Airways where the credit card details of 380,000 people were stolen. 

British Airways revealed late last week that hundreds of thousands of its customers' personal and financial details had been stolen between August 21 and September 5.

RiskIQ researcher Yonathan Klinjsma said a shadowy group called Magecart, which is believed to have links to Russia, may have been responsible.

The group is known for carrying out devastating web-based credit card skimming scams and has been active since at least 2015, according to RiskIQ, a cyber-security consulting firm. 

It carries out its attacks by loading a malicious piece of code onto a website and siphoning off private data off to a remote server.

Mr Klinjsma said there is evidence that Magecart carried out both the BA attack and the hack on Ticketmaster in June, which affected around 40,000 customers. 

In the latest hack on BA, 22 lines of modified code were inserted onto the airline's baggage claim page. The code is believed to have been an updated version of Magecart's trademark script.

Mr Klinjsma said it now appears hackers may have had access to the British Airways site from August 15, which would have given them time to prepare the attack. 

The RiskIQ experts said: "The attack was similar to the one leveled against Ticketmaster with one key difference: instead of compromising commonly used third-party functionality to gain access to hundreds of sites at once, Magecart operatives compromised the British Airways site directly and planned their attack around the site’s unique structure and functionality.

"While we can never know how much reach the attackers had on the British Airways servers, the fact that they were able to modify a resource for the site tells us the access was substantial, and the fact they likely had access long before the attack even started is a stark reminder about the vulnerability of web-facing assets."

British Airways declined to comment on whether Magecart had been involved in the breach, saying: "As this is a criminal investigation, we are unable to comment on speculation."

The BA breach was the latest in a series of attacks on the airline sector, including on Air Canada, which revealed data from 20,000 customers had been stolen, and on Thomas Cook which admitted names, emails and flight details of customers had been compromised.