Not third party code
This wasn't due to any third party code. The original breach involved somebody changing BA's own JS code to insert additional functions.
This latest one may be different, but there aren't any details as yet. What is somewhat odd is that this one predated the other one, and based on the published dates ended much earlier. So did somebody spot this at the time and remove the offending code? Only for it to re-appear elsewhere on their site later. Or did the person who added it realise there was a better place for it, so removed it themselves?
Biting the hand that feeds IT
