Regulator action · 16 October 2020
ICO monetary penalty notice: British Airways
ICO Monetary Penalty Notice, 16 October 2020 · Information Commissioner's Office (UK)
What it means for your code
Third-party scripts on checkout pages and hard-coded credentials are breach vectors regulators expect you to have controlled.
What happened
Attackers diverted BA website users to a fraudulent site and harvested personal and payment card details of around 400,000 customers in 2018.
What was decided
Failure to implement appropriate security measures (e.g. MFA, limiting application access, protecting against script tampering) breached the security principle.
⚖ GBP 20 million monetary penalty
The legal test applied
- Controllers must implement appropriate technical and organisational security (Arts. 5(1)(f) and 32)
- Measures available at reasonable cost — MFA, script integrity controls, least privilege — define what is appropriate
Information Commissioner's Office, ICO Monetary Penalty Notice, 16 October 2020, 2020-10-16, licensed under the Open Government Licence. Summary and analysis by Lawpatch. Open Government Licence v3.0 Risk analysis, not legal advice; the law may have moved on since this decision.