British Airways says it is facing a record fine of £183m for last year’s breach of its security systems. The penalty imposed on BA is the first one to be made public since those rules were introduced and amounts to 1.5% of its worldwide turnover in 2017, less than the possible maximum of 4%.
The airline, owned by IAG, says it was “surprised and disappointed” by the penalty from the Information Commissioner’s Office (ICO). At the time, BA said hackers had carried out a “sophisticated, malicious criminal attack” on its website.
The ICO said it was the biggest penalty it had ever handed out and the first to be made public under new rules.
Until now, the biggest penalty was £500,000, imposed on Facebook for its role in the Cambridge Analytica data scandal. That was the maximum allowed under the old data protection rules that applied before GDPR.
BA has 28 days to appeal. Willie Walsh, chief executive of IAG, said British Airways would be making representations to the ICO. “We intend to take all appropriate steps to defend the airline’s position vigorously, including making any necessary appeals,” he said.
BA has previously said approximately 380,000 transactions were affected, but the stolen data did not include travel or passport details.
The information included names, email addresses, credit card information such as credit card numbers, expiration dates and the three-digit CVV code found on the back of credit cards, although BA has said it did not store CVV numbers.
The news should come as a wake up call for the UK C-Suite, who seem to have been lulled into complacency by the “Soft Launch” of the GDPR – This incident was first disclosed on 6 September 2018, the “hack” was discovered just 24 hours before, so the level of the fine indicates that the GDPR honeymoon is now over, organisations have constantly been told that speed of reporting a breach is not considered as mitigation against poor Data practice.
Alex Cruz, British Airways’ chairman and chief executive, said: “We are surprised and disappointed in this initial finding from the ICO.
“British Airways responded quickly to a criminal act to steal customers’ data. We have found no evidence of fraud/fraudulent activity on accounts linked to the theft.
“We apologise to our customers for any inconvenience this event caused.”
