IAG subsidiary British Airways received a £20 million data-protection fine following a cyberattack
Summary
In October 2020, the UK Information Commissioner's Office imposed a £20 million penalty on British Airways following a cyberattack affecting customers' personal data. The attack ran from 22 June through 5 September 2018. The compromised information included personal and payment-card data belonging to more than 400,000 customers and staff. The regulator found that British Airways had failed to process personal data in a manner ensuring appropriate security. This record is assigned to International Consolidated Airlines Group because British Airways is an IAG subsidiary; the monetary penalty itself was imposed on British Airways plc. Source / proof: UK Information Commissioner's Office penalty notice: https://ico.org.uk/media2/migrated/2618421/ba-penalty-20201016.pdf
Record details
- Category
- Corporate Misconduct
- When it happened
- June 22, 2018–September 5, 2018
- Status
- Resolved (October 16, 2020)
- Severity
- high
- Added to Rotten Company
Source
No source document is attached to this record. It was approved under our moderation guidelines.