British Airways has been fined £20m for "unacceptable" mistakes that led to the theft of the personal data of hundreds of thousands of customers in 2018.
The fine represents the largest financial penalty issued to date by the UK Information Commissioner's Office (ICO) and is based on the GDPR.
The incident began in the summer of 2018 and went undetected by the airline for over two months, before finally being made public in September 2018.
Over 400,000 British Airways customers who used the website during the summer of 2018 were redirected to a fraudulent website run by cyber attackers ,who collected personal information, including names, addresses and payment card information.
An ICO investigation concluded that British Airways should have been able to identify the cybersecurity weaknesses and resolve them with the security measures available at the time.
The ICO investigation concluded that there were several measures British Airways could have taken to mitigate the attack.
These include restricting access to specific applications, conducting rigorous penetration tests , and protecting accounts with multi-factor authentication.
The ICO notes that none of these measures required “excessive costs or technical barriers” and that some of these developed security were available but not used.
The investigation also concluded that it is “unclear” whether British Airways would have detected the attack itself , had it not been notified of the incident by a third party. The ICO considers the incident a “serious failure” due to the number of people affected.
However, following the attack, the ICO notes that British Airways has made “significant” improvements to its information security procedures.
