British Airways could face potential £800 million lawsuit over 2018 data breach

British Airways (BA) could face a potential £800 million lawsuit over a 2018 data breach.

More than 16,000 people have signed up to the plan to litigate against the UK’s flag carrier, in what lawyers behind the case call the biggest group-action personal data claim in British history.

Lawyers at PGMBM said they believe each of the 420,000 customers and staff whose information were leaked could be entitled to £2,000 each in compensation. It could cost the company more than £800 million.

In September 2018, BA revealed a breach in its systems which leaked names, debit and credit card numbers, addresses and email addresses.

Some passengers were diverted to a fake website, which harvested their details.

The Information Commissioner (ICO) originally planned to fine BA £183 million for the breach, the largest penalty in the watchdog’s history.

This was later reduced to £20 million as the airline faced serious financial pressures during the Covid-19 pandemic.

“British Airways passengers feel let down by what transpired. They are well within their rights to be compensated for what was previously a trusted airline playing fast and loose with their personal information, leaving it vulnerable for nefarious hackers to take advantage of,” said Tom Goodhead, a partner at PGMBM.

“We trust companies like British Airways with our personal information and they have a duty to all of their customers and the public at large to take every possible step to keep it safe. In this instance, they presided over a monumental failure.”

British Airways said: “We continue to vigorously defend the litigation in respect of the claims brought arising out of the 2018 cyber attack. We do not recognise the damages figures put forward, and they have not appeared in the claims.”

Mr Goodhead said that the Information Commissioner was right to reduce its fine for BA over the breach.

“But the ICO set forth in no uncertain terms that BA failed to take adequate measures to keep the vital personal and financial information of its passengers secure.

“It’s yet another instance of a massive corporate entity showing complete disregard for their customers, and those customers deserve some redress.”

In 2019 a High Court judge ruled that BA customers could go ahead with compensation claims against the airline over the data breach.