British Airways pays out on data breach

[July 2021]

British Airways (BA) has reached an out-of-court settlement with the victims of a data breach that exposed personal data belonging to more than 420,000 customers.

Under the agreement with PGMBM, the court-appointed law firm representing victims, the airline will pay thousands of claimants an undisclosed sum. The resolution does not include any admission of liability on the part of the operator.

“This represents an extremely positive and timely solution for those affected by the data incident,” said PGMBM chairman Harris Pogust in a statement.

“The pace at which we have been able to resolve this process with British Airways has been particularly encouraging and demonstrates how seriously the legal system is taking mass data incidents.”

In response to a request for comment from The Daily Swig, British Airways said: “We apologised to customers who may have been affected by this issue and are pleased we've been able to settle the group action. When the issue arose we acted promptly to protect and inform our customers.”

The case centers on a 'Magecart'-style hack of BA’s payment processing infrastructure that in 2018 diverted unsuspecting victims to a malicious website where names, debit and credit card details, postal addresses, and email addresses were harvested over a 15-day period.

Login credentials of BA employee and ‘Executive Club accounts were also potentially accessed.

In January, PGMBM said more than 16,000 victims had submitted compensation claims with four months left until the claims window closed, making it “the largest group action personal data claim in UK history”.

It estimated that “victim compensation could be up to £2,000 [$2,770] putting BA’s overall potential liability at around £800 million [$1.1 billion]”.

What would have been a record-breaking fine of £183 million [$253 million] for infringements of the General Data Protection Regulation (GDPR) was last year reduced to £20 million [$27.7 million] after the UK Information Commissioner’s Office (ICO) took into account the economic impact of Covid-19 on BA.

However, the sum is still the largest dished out by the ICO and the fourth biggest penalty levied by any European regulator since GDPR came into force in 2018.