British Airways dodges £183 million data breach fine after coronavirus disruption

The Information Commissioner's Office will now fine the airline £20 million for a data breach that affected over 400,000 customers

The Information Commissioner’s Office has said it will now fine British Airways £20 million following a breach of its systems in 2019, which is significantly lower than the £183 million penalty originally announced against the company.

The UK’s data watchdog said that the final figure had taken into account appeals from British Airways and the economic fallout from the ongoing coronavirus pandemic.

British Airways revealed it had fallen victim to a cyber attack in September 2018, and that the financial and personal details of around 380,000 customers had been lost.

This was followed by a second incident a month later, with the company admitting that a further 185,000 customers who made bookings using its Avios rewards system during that time may have also been affected.

Following an investigation by the ICO, the attack is said to have involved 429,612 customers and staff in total, with names, addresses, payment card numbers, and CVV numbers of 244,000 customers being lost.

In July 2019, the ICO announced its intention to fine British Airways £183 million, approximately 1.5% of the company’s annual turnover, considered to be the largest fine ever issued against a company under GDPR.

While the new £20 million fine is the largest the ICO has issued to date, it’s still lower than the £50 million fine issued by French regulator CNIL against Google in 2019.

“People entrusted their personal details to BA and BA failed to take adequate measures to keep those details secure,” said Information Commissioner Elizabeth Denham, announcing the enforcement on Friday.

“Their failure to act was unacceptable and affected hundreds of thousands of people, which may have caused some anxiety and distress as a result. That’s why we have issued BA with a £20m fine – our biggest to date.

The regulator said that British Airways had failed to take basic actions to protect customer data, including a lack of multi-factor authentication across at least 13 critical applications. The regulator claims that many basic measures were available for free through the airline’s use of Microsoft Windows, but were not enforced.

It was also found that British Airways was only alerted to the data breach when a third party raised the issue more than two months later, and that there was little evidence that the airline would have ever been able to identify the attack itself.

Related Resource

Data: A resource much too valuable to leave unprotected

Protect your data to protect your company

Download now

This latter point was considered a severe failing by the watchdog, although it has recognised that security has significantly improved in the months following the ICO's investigation.

"We alerted customers as soon as we became aware of the criminal attack on our systems in 2018 and are sorry we fell short of our customers’ expectations," a British Airways spokesperson said on Friday.

"We are pleased the ICO recognises that we have made considerable improvements to the security of our systems since the attack and that we fully co-operated with its investigation."

Featured Resources

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Simplify cluster security at scale

Centralised secrets management across hybrid, multi-cloud environments

Download now

The endpoint as a key element of your security infrastructure

Threats to endpoints in a world of remote working

Download now

2021 state of IT asset management report

The role of IT asset management for maximising technology investments

Download now

Most Popular

Do smart devices make us less intelligent?
artificial intelligence (AI)

Do smart devices make us less intelligent?

19 Oct 2020
Politicians need to stop talking about technology
Policy & legislation

Politicians need to stop talking about technology

21 Oct 2020
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

21 Oct 2020