Talk:British Airways data breach
Page contents not supported in other languages.
 | British Airways data breach is currently a Computing and engineeringgood article nominee.Nominated byJoe (talk) at 11:50, 26 November 2025 (UTC) Any editor who hasnot nominated or contributed significantly to this article may review it according to thegood article criteria to decide whether or not to list it as agood article. To start the review process,click here and then save the page. (See here for thegood article instructions.)
Short description: 2018 breach of British Airways customer data |
 | British Airways data breach was nominated as aEngineering and technology good article, but it did not meet thegood article criteria at the time (December 16, 2024,reviewed version). There are suggestions onthe review page for improving the article. If you can improve it,please do; it may then berenominated. |
 | This article is ratedStart-class on Wikipedia'scontent assessment scale. It is of interest to the followingWikiProjects: | |||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||
Joe (talk)07:21, 11 December 2024 (UTC)[reply]
The following discussion is closed.Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.
| GA toolbox |
|---|
| Reviewing |
Nominator:Joereddington (talk ·contribs)13:44, 26 November 2024 (UTC)[reply]
Reviewer:RoySmith (talk·contribs)23:59, 14 December 2024 (UTC)[reply]
Before I dig into the review proper, my initial impression is that this is way too short. I know we don't have any specific length requirements, but looking at the two most similar GAs (2022 Optus data breach andYahoo data breaches), both of those are about 2000 words. Ignoring the large block quote (which itself is about 25% of the text), this is about a third of that. Looking atWP:GACR6 3a ("it addresses the main aspects of the topic") and comparing the depth of coverage here to the depth of coverage in those other articles, I'm unsure if this meets the requirement.@Schierbecker andVaticidalprophet: you were the reviewers of those other articles, so I'd be interested to hear your impression of this one before I go any further.RoySmith(talk)23:59, 14 December 2024 (UTC)[reply]
data that British Airways was improperly recordingwhat does "improperly recording" mean in this context? Were they recording data that they should not have recorded at all, or were they just not protecting it properly?
redirected users of British Airways website to a bogus siteis "redirected" being used here in thetechnical HTTP sense, or in the more generic sense of telling their users to go there?
users of British Airways websitemissing "the" before British Airways?
an attacker gained access to British Airways Networkwhy is Network capitalized?
by means of compromised credentialsa non-technical reader will not know what a "compromised credential" is.
The compromised account did not have multi-factor authentication enabled. Again, WP:TECHNICAL. Most people won't have a clue what MFA is or why it's significant. You don't have to go into great detail, but some kind of "why should I care?" explanation is needed.
The attacker was initially restricted to a Citrix environmentMore of the same. I know what Citrix is, but most readers won't, so they won't understand why this is significant. Likewise, they won't understand what it means that the attacker "broke out of the environment"
administrator password stored in plaintextand
the attacker found plain text files. I know that you mean "not encrypted", but a non-technical reader won't know this. For most people, "plain text" means (quoting my wife, who is more technical than most and whom I just asked as a test) "not formatted, doesn't have any funny **** in it").
OK, I'm going to stop here. Looking over the rest of the article, there's more of the same. I'm afraid I'm going to have to quick-fail this for being "a long way from meeting" the requirement to be "understandable to an appropriately broad audience". My general recommendation is that every time you talk about some bit of technology (i.e. a javascript library), give the reader some idea of what it is, why what BA was doing with it was problematic, and how this contributed to the data breach. I totally agree with you that pulling in a large collection of silly quotes is not useful, so don't do that. That's not what I was referring to when I said this didn't go into enough depth.RoySmith(talk)16:59, 16 December 2024 (UTC)[reply]
