British Airways fined £20m for data breach affecting over 400,000 customers
The Information Commissioner’s Office (ICO) has fined British Airways (BA) £20m ($26m) for failing to protect the personal and financial details of more than 400,000 of its customers.
In June 2018, the personal data of approximately 429,612 customers and staff, is believed to have been accessed. This included names, addresses, payment card numbers and card verification value (CVV) bank numbers of 244,000 BA customers.
Investigators found that BA should have identified security weaknesses. The carrier did not detect the hack for more than two months.
The airline failed to protect the personal and financial details of its customers, which broke data protection law. BA should have resolved the issues with the security measures that were available at the time, ICO said.
In conclusion, investigators said that addressing these security issues would have “prevented the 2018 data breach being carried out in this way.”
As the hack happened before the UK left the EU, the ICO investigated on behalf of all EU authorities as lead supervisory authority under the General Data Protection Regulation (GDPR).
The penalty and action have been approved by the other EU data protection authorities (DPAs) through the GDPR’s cooperation process.
Information Commissioner Elizabeth Denham said: “People entrusted their personal details to BA and BA failed to take adequate measures to keep those details secure.
“Their failure to act was unacceptable and affected hundreds of thousands of people, which may have caused some anxiety and distress as a result. That’s why we have issued BA with a £20m fine – our biggest to date.
“When organisations take poor decisions around people’s personal data, that can have a real impact on people’s lives. The law now gives us the tools to encourage businesses to make better decisions about data, including investing in up-to-date security.”
BA was given a notice of intent to fine by ICO in July 2019, the commissioner then said that BA could be fined more than £183m. This is more than nine times the £20m the carrier has eventually been fined.
The ICO said it considered “representations from BA and the economic impact of COVID-19 on their business” before setting the final penalty.
Other details thought to have been accessed include the combined bank card and CVV numbers of 77,000 customers and card numbers only for 108,000 customers.
Usernames and passwords of BA employee and administrator accounts as well as usernames and PINs of up to 612 BA Executive Club accounts were also potentially exposed.
Reference: Yahoo News: Suban Abdulla: