This article is more than 1 year old

UK privacy watchdog threatens British Airways with 747-sized fine for massive personal data blurt

Half a million records lost? £183m GDPR fine lined up

The UK Information Commissioner's Office has warned British Airways it faces a whopping £183.39m fine following the theft of customer records from its website and mobile app servers.

The record-breaking fine - more or less the lower end of the price of one of the 747-400s in BA's fleet - under European General Data Protection Regulation (GDPR), represents 1.5 per cent of BA’s world-wide revenue in 2017.

Information Commissioner Elizabeth Denham said: "People's personal data is just that – personal. When an organisation fails to protect it from loss, damage or theft it is more than an inconvenience. That’s why the law is clear – when you are entrusted with personal data you must look after it. Those that don’t will face scrutiny from my office to check they have taken appropriate steps to protect fundamental privacy rights."

The security breach hit almost 500,000 people. The ICO statement reveals the cyber-intrusion is believed to have started in June 2018, whereas previous statements from BA said it began in late August. The data watchdog described the attack as diverting user traffic from BA's site to a fraudulent site.

ICO investigators found a variety of information was compromised including log-in details, card numbers, names, addresses and travel information.

Sophisticated card skimming group Magecart, which also hit Ticketmaster, was blamed for the data slurp. The group is believed to have exploited third party scripts, possibly modified JavaScript, running on BA's site to gain access to the airline's payment system.

Such scripts are often used to support marketing and data tracking functions or running external ads.

British Airways website

British Airways: If you're feeling left out of our 380,000 passenger hack, then you may be one of another 185,000 victims


The Reg revealed that BA parent company IAG was in talks with staff to outsource cyber security to IBM just before the hack was carried out.

The ICO acted as lead investigator but liaised with several other European Union regulators. It said BA cooperated with its investigation and had now made security improvements to its site.

BA and the other regulators now have 28 days to make representations to reduce the fine.

In response, the airline said it was disappointed in the fine because it cooperated fully and had found no evidence that the stolen cards were used. It said it would make representations and appeal the decision.

The ICO statement is here. ®

More about


Send us news

Other stories you might like