Fine · United Kingdom
British Airways plc: GBP 20,000,000
- Authority
- Information Commissioner's Office (United Kingdom)
- Country
- United Kingdom
- Date
- Decision of 16 October 2020
- Amount
- GBP 20,000,000, as imposed (not converted)
- Appeal status
- Unknown
- Provisions cited
- Article 5(1)(f), Article 32
What the fine was for (summary, not the official text)
An attacker used compromised remote-access credentials and altered a script on the airline's website to send customers' card data to an outside domain (22 June to 5 September 2018).
Checked against the official source on 28 October 2026.
Only the authority's decision is authoritative. This is reference material, not legal advice.