British Airways faces record data theft fine

The Information Commissioner's Office (ICO) of the United Kingdom announced on Monday that it will impose a record fine of 183.39 million pounds on British Airways for widespread breaches of the General Data Protection Regulation (GDPR).

According to a statement issued by the regulator, the proposed fine relates to a cyber incident which is believed to have started in June 2018 and which British Airways notified to the ICO in September last year.

According to the ICO, user traffic to the British Airways website was diverted to a fraudulent site, as a result of which "customer details were harvested by the attackers. Personal data of approximately 500,000 customers were compromised."

The watchdog stated that "a variety of information was compromised by poor security arrangements at the company, including log in, payment card and travel booking details as well as name and address information."

Information Commissioner Elizabeth Denham said: "People's personal data is just that -- personal. When an organisation fails to protect it from loss, damage or theft it is more than an inconvenience.

"That's why the law is clear -- when you are entrusted with personal data you must look after it. Those that don't will face scrutiny from my office to check they have taken appropriate steps to protect fundamental privacy rights."

The ICO noted that British Airways will now have the opportunity to "make representations" to the regulatory body.

"We are surprised and disappointed in this initial finding from the ICO," said Alex Cruz, chairman and chief executive of British Airways, adding that British Airways responded quickly to a criminal act to steal customers' data.

"We have found no evidence of fraud/fraudulent activity on accounts linked to the theft," Cruz said.

Willie Walsh, CEO of British Airways's parent company International Airlines Group, said British Airways will make representations to the ICO on the proposed fine.

"We intend to take all appropriate steps to defend the airline's position vigorously, including making any necessary appeals," he said.