The UK regulator Information Commissioner's Office (ICO) has fined British Airways (BA) £20 million for a major data breach from 2018.(1) As recently as July 2019, the ICO announced that a fine of £183 million would be imposed. Now, upon the actual imposition of the fine, the fine amount comes to £20M partly because of the economic impact of COVID-19 on BA's operations.
The incident in question involved a violation of the General Data Protection Regulation (GDPR) in that the security of BA's customer data was (far) below par. This subsequently led to a cyber attack on BA's systems in 2018, in which the data of more than 400,000 customers was compromised. The affected data included credit card data, often in combination with the CVV code.
In addition, BA did not itself notice the cyber attack, which occurred on June 22, 2018. Only on Sept. 5, after being alerted to the data breach by a third party, did BA take action. Of concern is BA's apparent inability at the time to detect the weakness and a subsequent misuse thereof. The ICO rightly questions how long it would have taken BA itself to detect the cyber-attack, if it detected it at all.
The ICO further charges BA seriously that the state of the art at the time of the cyber-attack was such that the weakness in BA's security was unnecessary. Had BA employed a level of security common at the time, it could have prevented the successful cyber-attack in 2018 in a relatively simple manner.
Incidentally, after BA did become aware of the weakness in its system and the cyber-attack, it acted energetically and correctly by reporting the incident to the ICO and making significant improvements to its IT security. That, along with the additional information provided by BA and the tough times the airline has faced since then due to COVID-19, led to the significantly reduced fine ultimately imposed by the ICO.
(1) https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2020/10/ico-fines-british-airways-20m-for-data-breach-affecting-more-than-400-000-customers/
More articles by Kennedy Van der Laan
