British Airways has settled a class-action lawsuit brought by thousands of customers and staff that were caught up in a massive 2018 data breach that saw personal details and credit card information leaked for weeks before the airline finally realised its computer systems had been compromised.
As many as 420,000 customers had their personal data leaked but the settlement between British Airways and law firm PGMBM doesn’t include any admission of liability on the part of the airline.
The law firm said the customers it represented would receive a confidential settlement which was agreed out of court in mediation between the two sides. A separate law firm claimed in January that British Airways could face a total bill of £3 billion ($4.12 billion) to settle the lawsuit based on each victim receiving £6,000 each.
At the time, British Airways said it did not “recognise the damages figures that Your Lawyers has put forward, and they have not appeared in the claims.”
Customers who were affected by the data breach had until March 19 to the Group Litigation Order against British Airways.
The Information Commissioners Office (ICO) proposed a £180 million fine against British Airways for breaking data protection laws but the watchdog slashed that penalty to just £20 million on appeal. The ICO said it had considered the financial shock brought about by the Coronavirus pandemic for reducing the penalty imposed on the airline.
An investigation concluded that hackers managed to break into BA’s computer system and access personal data for up to two months without detection. The ICO said BA should have had systems in place to identify a cyber attack and take action much sooner.
In its final ruling, the ICO said it was “severe failing” that it took so long for British Airways to identify the breach.
British Airways says it is pleased that it has managed to settle the lawsuit. The airline says it “acted promptly to protect and inform our customers” when it realised what had happened.
