British Airways has been fined £20m ($26m) by the Information Commissioner's Office (ICO) for a data breach in 2018 that compromised the personal and credit card details of more than 400,000 customers. The penalty is considerably lower than the £183m originally proposed in 2019, with the ICO citing the economic impact of Covid-19 as a factor in the reduction.
The breach occurred when attackers compromised BA's systems and modified them to harvest customer data as it was entered. It took two months for the airline to become aware of the incident, after being alerted by a security researcher. Stolen data included login credentials, payment card information, travel booking details, names and addresses.
An investigation found that sufficient security measures, such as multi-factor authentication, were not in place at the time, despite some being available on the Microsoft operating system BA was using. Information Commissioner Elizabeth Denham stated: "When organisations take poor decisions around people's personal data, that can have a real impact on people's lives. The law now gives us the tools to encourage businesses to make better decisions about data, including investing in up-to-date security."
British Airways said it had alerted customers as soon as it discovered the attack and had made considerable security improvements since. A spokesman added: "We are pleased the ICO recognises that we have fully co-operated with its investigation." Data protection officer Carl Gottlieb described the £20m fine as "massive" in the current climate, saying it shows the ICO is not letting struggling companies off the hook.
The fine is the largest issued by the ICO to date and marks the commissioner's first major penalty under GDPR. The delay of over two years between the incident and the fine has drawn criticism, but the ICO said it worked methodically to ensure a correct outcome. The final figure, far lower than the initial proposal, has surprised many, but remains a significant moment for data privacy enforcement.
