International Consolidated Airlines Group S.A. Rotten Score Breakdown

In October 2020, the UK Information Commissioner's Office imposed a £20 million penalty on British Airways following a cyberattack affecting customers' personal data. The attack ran from 22 June through 5 September 2018. The compromised information included personal and payment-card data belonging to more than 400,000 customers and staff. The regulator found that British Airways had failed to process personal data in a manner ensuring appropriate security. This record is assigned to International Consolidated Airlines Group because British Airways is an IAG subsidiary; the monetary penalty itself was imposed on British Airways plc. Source / proof: UK Information Commissioner's Office penalty notice: https://ico.org.uk/media2/migrated/2618421/ba-penalty-20201016.pdf