pageview
W1siziisimnvbxbpbgvkx3rozw1lx2fzc2v0cy9eq0wvanbnl2jhbm5lci1kzwzhdwx0lmpwzyjdxq

UK privacy watchdog threatens British Airways with 747-sized fine for massive personal data blurt

over 1 year ago by Lucy Cinder

UK privacy watchdog threatens British Airways with 747-sized fine for massive personal data blurt

Cyber Security

The UK Information Commissioner's Office has warned British Airways it faces a whopping £183.39m fine following the theft of customer records from its website and mobile app servers.

The record-breaking fine - more or less the lower end of the price of one of the 747-400s in BA's fleet - under European General Data Protection Regulation (GDPR), represents 1.5 per cent of BA’s world-wide revenue in 2017.

Information Commissioner Elizabeth Denham said: "People's personal data is just that – personal. When an organisation fails to protect it from loss, damage or theft it is more than an inconvenience. That’s why the law is clear – when you are entrusted with personal data you must look after it. Those that don’t will face scrutiny from my office to check they have taken appropriate steps to protect fundamental privacy rights."

The security breach hit almost 500,000 people. The ICO statement reveals the cyber-intrusion is believed to have started in June 2018, whereas previous statements from BA said it began in late August. The data watchdog described the attack as diverting user traffic from BA's site to a fraudulent site.

ICO investigators found a variety of information was compromised including log-in details, card numbers, names, addresses and travel information.

Sophisticated card skimming group Magecart, which also hit Ticketmaster, was blamed for the data slurp. The group is believed to have exploited third-party scripts, possibly modified JavaScript, running on BA's site to gain access to the airline's payment system.

Such scripts are often used to support marketing and data tracking functions or running external ads.

The Reg revealed that BA parent company IAG was in talks with staff to outsource cybersecurity to IBM just before the hack was carried out.

The ICO acted as a lead investigator but liaised with several other European Union regulators. It said BA cooperated with its investigation and had now made security improvements to its site.

BA and the other regulators now have 28 days to make representations to reduce the fine.

In response, the airline said it was disappointed in the fine because it cooperated fully and had found no evidence that the stolen cards were used. It said it would make representations and appeal the decision.

source theregister

Industry: Cyber Security

 
Blank

Latest Jobs