easyJet is facing a class-action lawsuit valued at up to £18 billion for a massive data breach involving the personal travel details of nine million customers which were illegally accessed by hackers. The Information Commissioners Office is already investigating the breach which was made public last month. Around 2,208 customers also had their credit card details stolen in what was described as a “highly sophisticated” cyber attack.
More than 10,000 affected customers have so far joined the class-action suit brought by the law firm PGMBM. The firm, which has even set up a dedicated website called ‘the easyJet claim’, believes victims might be entitled to up to £2,000 compensation if their claims succeed.
If the maximum amount of possible compensation is awarded, easyJet could face a bill of as much as £18 billion.
“This is a monumental data breach and a monumental failure that has a serious impact on EasyJet’s customers,” explained Tom Goodhead, a PGMBM managing partner. Goodhead said lawyers would be seeking compensation under Article 82 of the European Union’s General Data Protection Regulations that allows for damages from “inconvenience, distress, annoyance, and loss of control” of personal data.
“This is personal information that we trust companies with, and customers should rightly expect that every effort is made to protect that,” Goodhead continued. “Unfortunately, EasyJet has spilled the sensitive personal information of nine million customers from all corners of the world.”
easyJet acknowledged that a lawsuit had been filed in London’s High Court but explained that such claims are “not uncommon” and that other law firms were already chasing possible claimants.
“Just because these firms are advertising does not mean they have a strong claim,” a spokesperson for the British low-cost airline commented.
easyJet remains in talks with the ICO over the data breach. The airline said it believed that none of the stolen credit card details are believed to have been used improperly. In 2018, British Airways was slapped with a record £183 million fine by the ICO over an even bigger data breach. BA continues to fight the judgement.
