The Information Commissioner’s Office (ICO) has imposed a £183 million fine on British Airways, the biggest fine to date under GDPR, for a data breach where the personal details of 500,000 customers were accessed by hackers.
The Breach
The breach, which involved criminals using what is known as a ‘supply chain hack’ took place between 21st August and 5th September 2018. The attackers were able to insert a digital skimming file, made up of only 22 lines of JavaScript code, into the online payment forms of BA’s website and app. The malicious page in the app (identified by a RiskIQ researcher) was built using the same components as the real website, thereby giving a very close match to the design and functionality of the real thing. The skimming file meant that payment details entered into the malicious page by customers were intercepted live by the hackers who are believed to have been part of the Magecart group. Encryption was ineffective because the details were stolen before it reached company servers.
The fact that CVV codes were taken in the attack, which are not meant to be stored by companies, was a strong indicator of live skimming ‘supply chain’ attack.
Magecart is also believed to have used a similar digital skimmer hidden in a third-party element (chatbot) of the payment process to hack the Ticketmaster websites where 40,000 UK users were affected.
500,000 Affected In BA Breach
A staggering 500,000 personal and customer payment details were stolen in the BA Breach including names, email addresses, and credit card details including card numbers, expiry dates and the three-digit CVV codes.
Why Such A Big Fine?
The record-breaking £183 million fine was imposed because, under the General Data Protection Regulation (GDPR), a company can be fined 1.5% of its worldwide turnover and a maximum 4% of its worldwide turnover. In the case of BA, the £183 million equates to 1.5% of its worldwide turnover in 2017.
The largest fine previous to this was imposed prior to GDPR under the old Data Protection Act where Facebook was fined £500,000 for its role in the sharing of customer data with Cambridge Analytica.
What Does This Mean For Your Business?
This enormous fine is a reminder of the powers granted to the ICO under GDPR and of just how seriously matters of data protection are now viewed, particularly where large companies which should have the protective measures in place are concerned. Even though BA has expressed surprise at the size of the fine it is worth remembering that 500,000 customer details were stolen including credit card numbers by what was actually a well-targeted and tailored but relatively simple method of attack. This exposed vulnerabilities in the payment systems of a big company that should really have been picked up earlier.
Despite the fine being £183 million at 1.5% of BA’s worldwide turnover, it could have been worse since the maximum fine is 4% of turnover. The fine for BA should send a powerful message to other corporations that they need to make the data protection of their customers a top priority.
