British Airways fined £20m for data breach affecting over 400,000 customers
The Information Commissioner’s Office (ICO) has fined British Airways (BA) £20m ($26m) for failing to protect the personal and financial details of more than 400,000 of its customers.
In June 2018, the personal data of approximately 429,612 customers and staff, is believed to have been accessed. This included names, addresses, payment card numbers and card verification value (CVV) bank numbers of 244,000 BA customers.
Investigators found that BA should have identified security weaknesses. The carrier did not detect the hack for more than two months.
The airline failed to protect the personal and financial details of its customers, which broke data protection law. BA should have resolved the issues with the security measures that were available at the time, ICO said.
The watchdog found that there were “numerous measures” BA could have used to prevent or reduce the impact of the attack, including undertaking rigorous testing on its systems and protecting accounts with multi-factor authentication. It said that none of the measures would have involved “excessive cost or technical barriers” and some were available through the operating system being used by BA.
ICO said that the airline has made “considerable improvements to its IT security” since the attack.
In conclusion, investigators said that addressing these security issues would have “prevented the 2018 data breach being carried out in this way.”
READ MORE: British Airways chief quits in major shakeup
As the hack happened before the UK left the EU, the ICO investigated on behalf of all EU authorities as lead supervisory authority under the General Data Protection Regulation (GDPR).
The penalty and action have been approved by the other EU data protection authorities (DPAs) through the GDPR’s cooperation process.
Information Commissioner Elizabeth Denham said: “People entrusted their personal details to BA and BA failed to take adequate measures to keep those details secure.
“Their failure to act was unacceptable and affected hundreds of thousands of people, which may have caused some anxiety and distress as a result. That’s why we have issued BA with a £20m fine – our biggest to date.
“When organisations take poor decisions around people’s personal data, that can have a real impact on people’s lives. The law now gives us the tools to encourage businesses to make better decisions about data, including investing in up-to-date security.”
Shares in International Consolidated Airlines Group (IAG.L), which owns BA, were down on Friday.
BA was given a notice of intent to fine by ICO in July 2019, the commissioner then said that BA could be fined more than £183m. This is more than nine times the £20m the carrier has eventually been fined.
The ICO said it considered “representations from BA and the economic impact of COVID-19 on their business” before setting the final penalty.
Other details thought to have been accessed include the combined bank card and CVV numbers of 77,000 customers and card numbers only for 108,000 customers.
READ MORE: Heineken fined £2m for breaching UK pubs code
Usernames and passwords of BA employee and administrator accounts as well as usernames and PINs of up to 612 BA Executive Club accounts were also potentially exposed.
A BA spokeswoman said: “We alerted customers as soon as we became aware of the criminal attack on our systems in 2018 and are sorry we fell short of our customers’ expectations.
“We are pleased the ICO recognises that we have made considerable improvements to the security of our systems since the attack and that we fully co-operated with its investigation.”
Watch: Coronavirus: British Airways boss Alex Cruz steps down as industry faces 'worst crisis'
