British Airways further noted that the breach only impacted customers who completed transactions during a specific timeframe—22:58 BST on August 21 through 21:45 BST on September 5. He identified all the unique scripts on the British Airways website, which would be targeted in a cross-site scripting attack, and then tracked them through time until he found one JavaScript component that had been modified right around the time the airline said the attack began. RiskIQ's data shows that scripts supporting the functionality of the payment forms on the British Airways' website were copied and modified to deliver payment information to an attacker-controlled server while maintaining their intended functionality to avoid detection.
RiskIQ, a cybersecurity firm, reports that it has discovered the software that was used to gather credit card information from the British Airways website. The firm further states that the "supply chain attack" was very similar to an earlier attempt to skim data from the Ticketmaster website.