British Airways is facing the possibility of a fine of £183.4 million due to a cyberattack on its systems last year.
The alleged penalty comes after a data breach that affected hundreds of thousands of customers who used British Airways' website between April and June 2018. The breach was reported in September.
This incident occurred due to traffic on the website being redirected to a fraudulent website. During this incident, personal information of approximately 500,000 customers was collected by the attackers, with the incident believed to have started in June 2018.
The ICO announced its intention to issue the fine under the General Data Protection Regulation , the European Union's data protection laws that came into force in May last year – and the amount it plans to issue as a penalty is the largest ever issued under the GDPR.
The customers' personal data and credit card information are believed to have been stolen by a cybercriminal group known as Magecart. The hacking group is known for hacking eshops and hiding JavaScript code that steals credit card information entered into major checkout pages.
Following what it described as an “extensive investigation”, the ICO found that information was compromised by “poor security arrangements” at British Airways. This involved security around login, payment card and travel booking details, as well as name and address information.
“People’s personal data is just that – personal. When an organization fails to protect it from loss or damage, it creates much more than just a sense of inconvenience for users,” said Elizabeth Denham.
“That's why the law is clear – when you are entrusted with personal data you must be careful.”.
British Airways chairman and CEO Alex Cruz said the company was “surprised and disappointed” by the ICO’s findings, claiming the company found “no evidence of fraudulent activity in accounts linked to the theft.”
British Airways has the opportunity within 28 days from the date of the decision to object and intends to do so - to be precise, the parent company International Airlines Group.
"We intend to take all necessary steps to defend British Airways' position vigorously," said IAG chief executive Willie Walsh.
A statement from the ICO says it will “carefully consider the submissions of the company and other interested data protection authorities before making its final decision.” The final amount of the fine may be lower.
The previous highest penalty issued by the ICO was £500,000. That was the maximum it could have sought under the old rules, and the amount Facebook for its role in the Cambridge Analytica.
