British Airways data breach lawsuit settled: Airline coughs up around £30m to make sueball bounce away
(2021/07/06)
- Reference: 1625576290
- News link: https://www.theregister.co.uk/2021/07/06/british_airways_data_breach_lawsuit_settled/
- Source link:
British Airways has settled the not-quite-a-class-action* lawsuit against it, paying around £32m to make the data breach case in the High Court of England and Wales go away.
PGMBM, one of the law firms which brought the group litigation against BA to the High Court, said in a statement that the case was settled on "confidential" terms.
"The resolution includes provision for compensation for qualifying claimants who were part of the litigation. The resolution does not include any admission of liability by British Airways Plc," said PGMBM.
[1]
The lawsuit was based on the 2018 BA data breach, where the credit card details of 380,000 people were stolen thanks to a Magecart infection on its payment processing pages.
[2]
[3]
The airline had been saving card details in plain text since 2015 and hadn't implemented MFA across the board, [4]as we reported when regulators fined BA for its pisspoor data security practices – including saving a Windows domain admin username and password in plain text.
A BA spokesman said: "We apologised to customers who may have been affected by this issue and are pleased we've been able to settle the group action. When the issue arose we acted promptly to protect and inform our customers."
[5]
A PGMBM spokesman confirmed to The Register that today's settlement - which includes no admission of wrongdoing - still counts as a win, so its no-win no-fee promise to individuals who signed up to receive cash payouts still holds true. With legal fees capped at 35 per cent of the total payout from BA, this is a bumper payday for the lawyers.
Law firm Keller Lenkner said on its [6]webpage advertising for claimants: "In our experience, and looking at similar cases, compensation of around £2,000 per claimant (on average) seems likely."
Sky News reported this morning that 16,000 people had applied to be part of the group litigation order (GLO), meaning the airline may have paid around £32m – potentially less – to prevent the case going to trial. It was pencilled in at the High Court for a trial next summer before today's settlement news broke. Neither side would comment on the settlement sum.
[7]Law firm seeking leak victims to launch £500m suit at British Airways
[8]UK privacy watchdog threatens British Airways with 747-sized fine for massive personal data blurt
[9]Airline-chasing lawyers leap on Easyjet for £18bn after 9m folks' data, itineraries nicked
[10]British Airways fined £20m for Magecart hack that exposed 400k folks' credit card details to crooks
The Information Commissioner's Office [11]fined BA £20m for the breach last year , having previously [12]threatened to impose a 747-sized penalty . The impact of the COVID-19 pandemic on the airline's finances was one of the main reasons for the fine being cut so drastically.
Back in 2018 when it was first mooted, the lawsuit was said to be [13]worth up to £500m if every single eligible customer signed up.
[14]
Harris Pogust, chairman of PGMBM, said in the law firm's statement: "The pace at which we have been able to resolve this process with British Airways has been particularly encouraging and demonstrates how seriously the legal system is taking mass data incidents. This is a very positive sign as we look ahead to what will be an even bigger case against EasyJet relating to their 2020 data breach, as well as other similar international actions."
That latter case is still [15]grinding through the courts . If all nine million people eligible to sue Easyjet for that airline's 2020 data breach were to sign up for that, it could cost the orange carrier up to £18bn. ®
Bootnote
Not everything went the lawyers' way in the BA litigation. A few months ago the law firms driving the GLO lost an attempt to make BA pay the costs of their adverts drumming up customers for the case, [16]leaving them on the hook for £433,000 . Small change in the world of data breach-chasing lawyers. ®
* This case, specifically, was a group litigation order (GLO) - you can read more on [17]collective litigation in English courts here .
Get our [18]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YOR@HmUrq4Nks@76DHv-VgAAAI4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YOR@HmUrq4Nks@76DHv-VgAAAI4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YOR@HmUrq4Nks@76DHv-VgAAAI4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2020/10/16/british_airways_ico_fine_20m/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YOR@HmUrq4Nks@76DHv-VgAAAI4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://kellerlenkner-databreach.co.uk/british-airways-data-breach/
[7] https://www.theregister.com/2018/09/11/ba_lawsuit/
[8] https://www.theregister.com/2019/07/08/ico_threatens_ba_with_huge_fine_for_huge_data_loss/
[9] https://www.theregister.com/2020/05/26/easyjet_sued_9m_data_breach/
[10] https://www.theregister.com/2020/10/16/british_airways_ico_fine_20m/
[11] https://www.theregister.com/2020/10/16/british_airways_ico_fine_20m/
[12] https://www.theregister.com/2019/07/08/ico_threatens_ba_with_huge_fine_for_huge_data_loss/
[13] https://www.theregister.com/2018/09/11/ba_lawsuit/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YOR@HmUrq4Nks@76DHv-VgAAAI4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.theregister.com/2020/05/26/easyjet_sued_9m_data_breach/
[16] https://www.mishcon.com/news/high-court-dismisses-claims-for-recovery-of-advertising-costs-in-group-litigation
[17] https://www.ashurst.com/en/news-and-insights/legal-updates/quickguide-collective-actions---uk-guide/
[18] https://whitepapers.theregister.com/
PGMBM, one of the law firms which brought the group litigation against BA to the High Court, said in a statement that the case was settled on "confidential" terms.
"The resolution includes provision for compensation for qualifying claimants who were part of the litigation. The resolution does not include any admission of liability by British Airways Plc," said PGMBM.
[1]
The lawsuit was based on the 2018 BA data breach, where the credit card details of 380,000 people were stolen thanks to a Magecart infection on its payment processing pages.
[2]
[3]
The airline had been saving card details in plain text since 2015 and hadn't implemented MFA across the board, [4]as we reported when regulators fined BA for its pisspoor data security practices – including saving a Windows domain admin username and password in plain text.
A BA spokesman said: "We apologised to customers who may have been affected by this issue and are pleased we've been able to settle the group action. When the issue arose we acted promptly to protect and inform our customers."
[5]
A PGMBM spokesman confirmed to The Register that today's settlement - which includes no admission of wrongdoing - still counts as a win, so its no-win no-fee promise to individuals who signed up to receive cash payouts still holds true. With legal fees capped at 35 per cent of the total payout from BA, this is a bumper payday for the lawyers.
Law firm Keller Lenkner said on its [6]webpage advertising for claimants: "In our experience, and looking at similar cases, compensation of around £2,000 per claimant (on average) seems likely."
Sky News reported this morning that 16,000 people had applied to be part of the group litigation order (GLO), meaning the airline may have paid around £32m – potentially less – to prevent the case going to trial. It was pencilled in at the High Court for a trial next summer before today's settlement news broke. Neither side would comment on the settlement sum.
[7]Law firm seeking leak victims to launch £500m suit at British Airways
[8]UK privacy watchdog threatens British Airways with 747-sized fine for massive personal data blurt
[9]Airline-chasing lawyers leap on Easyjet for £18bn after 9m folks' data, itineraries nicked
[10]British Airways fined £20m for Magecart hack that exposed 400k folks' credit card details to crooks
The Information Commissioner's Office [11]fined BA £20m for the breach last year , having previously [12]threatened to impose a 747-sized penalty . The impact of the COVID-19 pandemic on the airline's finances was one of the main reasons for the fine being cut so drastically.
Back in 2018 when it was first mooted, the lawsuit was said to be [13]worth up to £500m if every single eligible customer signed up.
[14]
Harris Pogust, chairman of PGMBM, said in the law firm's statement: "The pace at which we have been able to resolve this process with British Airways has been particularly encouraging and demonstrates how seriously the legal system is taking mass data incidents. This is a very positive sign as we look ahead to what will be an even bigger case against EasyJet relating to their 2020 data breach, as well as other similar international actions."
That latter case is still [15]grinding through the courts . If all nine million people eligible to sue Easyjet for that airline's 2020 data breach were to sign up for that, it could cost the orange carrier up to £18bn. ®
Bootnote
Not everything went the lawyers' way in the BA litigation. A few months ago the law firms driving the GLO lost an attempt to make BA pay the costs of their adverts drumming up customers for the case, [16]leaving them on the hook for £433,000 . Small change in the world of data breach-chasing lawyers. ®
* This case, specifically, was a group litigation order (GLO) - you can read more on [17]collective litigation in English courts here .
Get our [18]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YOR@HmUrq4Nks@76DHv-VgAAAI4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YOR@HmUrq4Nks@76DHv-VgAAAI4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YOR@HmUrq4Nks@76DHv-VgAAAI4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2020/10/16/british_airways_ico_fine_20m/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YOR@HmUrq4Nks@76DHv-VgAAAI4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://kellerlenkner-databreach.co.uk/british-airways-data-breach/
[7] https://www.theregister.com/2018/09/11/ba_lawsuit/
[8] https://www.theregister.com/2019/07/08/ico_threatens_ba_with_huge_fine_for_huge_data_loss/
[9] https://www.theregister.com/2020/05/26/easyjet_sued_9m_data_breach/
[10] https://www.theregister.com/2020/10/16/british_airways_ico_fine_20m/
[11] https://www.theregister.com/2020/10/16/british_airways_ico_fine_20m/
[12] https://www.theregister.com/2019/07/08/ico_threatens_ba_with_huge_fine_for_huge_data_loss/
[13] https://www.theregister.com/2018/09/11/ba_lawsuit/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YOR@HmUrq4Nks@76DHv-VgAAAI4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.theregister.com/2020/05/26/easyjet_sued_9m_data_breach/
[16] https://www.mishcon.com/news/high-court-dismisses-claims-for-recovery-of-advertising-costs-in-group-litigation
[17] https://www.ashurst.com/en/news-and-insights/legal-updates/quickguide-collective-actions---uk-guide/
[18] https://whitepapers.theregister.com/
Make Lawyers Rich Again
Anonymous Coward
After the PFI well ran dry, gotta find other revenue streams: Post masters' miscarriages of justice, data breaches ...
Re: Make Lawyers Rich Again
Anonymous Coward
Dieselgate is the current target for the ambulance-chasers.
Proper compensation
elsergiovolador
My view is that if a company leaks your personal details, they should make things be as before the leak.
Leaked your address? They should pay for a complete relocation, buy you a similar house, find your spouse and yourself a new job in the new area and so on.
Leaked your name? Pay for replacing all documents with a new name.
Leaked your photo? Pay for a plastic surgery.
Re: Leaked your photo? Pay for a plastic surgery
DJV
Nah, they should let the victims do some BOFH-style plastic surgery* on the CEO's face.
(* possibly with the aid of shovels and/or a convenient lift shaft)
Re: Proper compensation
Anonymous Coward
Leaked your photo? Pay for a plastic surgery.
And then pay for all the changes to biometric systems?
2000 pounds?
In America, you would be lucky to get a $200 discount coupon. No wait, I meant $20.
After waiting five years. After the final judgement. No, that is not an exaggeration.