British Airways fined $26m in UK probe over data attack

Bloomberg

British Airways was fined 20 million pounds ($26 million) by the UK data protection watchdog over a breach that compromised the personal and financial details of more than 400,000 customers, a cut to a much heftier fine initially planned by the regulator.
The UK Information Commissioners’ Office (ICO) said its investigation into a 2018 cyber-attack at the company found that “the airline was processing a significant amount of personal data without adequate security measures in place,” exposing people’s data unnecessarily. The fine is the ICO’s biggest so far. “Their failure to act was unacceptable and affected hundreds of thousands of people, which may have caused some anxiety and distress,” UK data protection chief Elizabeth Denham said.
The final penalty is a fraction of the 183.4 million pounds ($237 million) the ICO had initially announced it planned to levy last year. BA said its systems were compromised from August 21 through September 5, 2018 and that about 380,000 transactions had been affected, advising people to contact credit-card providers. It said the stolen data didn’t include travel or passport details.
In July, BA set aside $26 million as a provision for the inci dent. “The ICO recognises that we have made considerable improvements to the security of our systems since the attack and that we fully co-operated with its investigation,” a BA spokeswoman said in an email.