British Airways agrees to pay compensation in the 2018 data breach lawsuit

This article is closed to new comments. Feel free to ask your question in the HfP forums.

• Tw33ty says:

  6 Jul6 July 05:18

  Guess this will have a lot of people signing up to the likes of the Mercedes-Benz emissions bypass one now, and more cases for ba.

  Choo Choo, all aboard the gravy train…

• The Original David says:

  6 Jul6 July 06:35

  “Do not email me from your personal email account”

  … but anonymous emails are welcome…? 🙂

  • Tarmohamed says:

    6 Jul6 July 06:50

    This reminded me of studying law at university 😂

    • Peter Ould says:

      6 Jul6 July 13:57

      Tee hee.

      My father was a barrister and we grew up discussing slugs and ginger beer bottles over breakfast. Now I deal with contracts every day of my life, and am trying to teach my kids that words and what they precisely mean are really important.

  • Pb says:

    6 Jul6 July 06:54

    I think an anonymous letter safer .

  • Rui N. says:

    6 Jul6 July 06:58

    “You might think that; I couldn’t possibly comment”

  • Mike says:

    6 Jul6 July 07:28

    Or just publish it in comments !

    • Rob says:

      6 Jul6 July 07:38

      I will have to delete it due to contempt of court risks.

      Same reason I will need to delete it if anyone posts the reason for Michael Gove’s divorce ….

      • A says:

        6 Jul6 July 07:42

        There is no risk unless and until the settlement is actually approved at court, and you could comply by deleting at that time.

        But up to you if you want to take a very conservative positive to mitigate risk

      • Yuff says:

        6 Jul6 July 07:44

        Has he been doing a Hancock 🤣

        • Rantallion says:

          6 Jul6 July 08:32

          The Spectator published in 2016 some interesting speculation about Gove.

        • Sideshowbob says:

          6 Jul6 July 09:58

          With a GB news presenter 😂

        • Jonathan says:

          6 Jul6 July 14:40

          Twitter is full of all sorts of scurrilous rumours.

      • J says:

        6 Jul6 July 08:32

        Is it because he’s Michael Gove?

      • Keely says:

        6 Jul6 July 08:35

        I had zero interest in his divorce until I read this …now I feel I need to google it 🤣

        • Number9 says:

          6 Jul6 July 09:43

          Me too! It was obvious when she started losing loads of weight and taking more care of her appearance something was going on. I think he would prefer a mr gove than a mrs gove.

        • Yuff says:

          6 Jul6 July 09:51

          Number 9

          🤣

        • Nick says:

          6 Jul6 July 09:56

          Oooohhh now I also want to know!!

• gareth says:

  6 Jul6 July 06:42

  Where can I sign up!!?

  • Paul Pogba says:

    6 Jul6 July 06:48

    Too late. I didnt join either but I might next time. If the rumours of another breach are true they dont look like a company that learmt anything.

    • Ls says:

      6 Jul6 July 07:07

      Yup. It’s almost like they only learn when lots of people sue them for lots of money.

      • Paul Pogba says:

        6 Jul6 July 08:36

        The cost of paying off customers and solicitors needs to exceed their investment in IT before it will improve.

• Paul says:

  6 Jul6 July 07:21

  Rob, is your senior legal figure able to share a ballpark amount that would be typical of similar cases? i.e. are we talking £50 vs £500 vs £5000?

  • Andrew says:

    6 Jul6 July 07:33

    The lawyers website said “up to £2000” when they were trying to get signups.

    • Tw33ty says:

      6 Jul6 July 09:02

      Even if it only £50, of the 460000 people not part off the claim, im sure many will jump on the bandwagon.

      If it’s for more, might be a new ppi advert style boom on TV.

• John says:

  6 Jul6 July 07:24

  I didn’t sign up because the terms stated that I might be required to attend court or something at any time and if I didn’t I might be liable for the law firm’s costs.

  • BSI1978 says:

    6 Jul6 July 07:28

    Yup, seem to recall the discussion at the time on here centred on this; & presumably the costs could/will still eat into any award. Or is that for BA to cover?

    • JDB says:

      6 Jul6 July 08:31

      In a case like this it is likely BA will have agreed, as part of the settlement, to pay the claimant’s costs (and their own) but quite likely an agreed figure less than the full sum. The balance will come out of the settlement. If we see some headline figure for the settlement, you can’t simply divide that by 16,000 claimants as the un-recovered costs, success share and insurance etc. will eat a huge chunk.

      • Claire says:

        6 Jul6 July 09:33

        I’m not sure that it will be equally divided as claimants were affected differently. For example some suffered financial loss, some emotional distress, some both and I think this is taken in to consideration when dividing the money then – 30% to the law firm.

      • Claire says:

        6 Jul6 July 09:34

        Sorry misread “can’t” for “can”

  • ChrisW says:

    6 Jul6 July 07:54

    Class actions don’t work like that. The law firm takes on all the risk and then takes a huge chunk of the payout if there is one.

    • JDB says:

      6 Jul6 July 08:18

      They don’t take all the risk, the biggest of which is paying the other side’s costs if you lose. They will almost certainly have taken out ATE insurance, the premium for which will be paid for out of the settlement in addition to the % success fee.

    • Rob says:

      6 Jul6 July 08:30

      It was true that a selection of claimants would need to appear in court.

      • 1ATL says:

        6 Jul6 July 13:14

        According to the information, BA settled out of court before anyone had an opportunity to see the inside of a courtroom and give any evidence of wrong doing. People genuinely affected by the data breach presumably still have the opportunity to turn down the kind offer of an out of court settlement and take it to the courtroom if they so desire?

• Ian says:

  6 Jul6 July 07:32

  I hate this compensation culture. BA acted promptly to mitigate any effects by providing a year’s subscription to Experian. Can anyone out there honestly say they lost anything?
  I would have thought most HfP readers would be more interested in flying again and doing their best to help our flag carrier after the pathetic lack of support from Govt.

  • A says:

    6 Jul6 July 07:43

    You’re right, I imagine it would be beyond the fraudsters to wait for 12 months wouldn’t it

    • Chrisasaurus says:

      6 Jul6 July 09:00

      They don’t need to wait – the fraudsters business model doesn’t rely on the victim never finding out!

  • Vic says:

    6 Jul6 July 08:27

    I too hate compensation culture. My data was breached at BA and shortly afterwards my eBay, Netflix and Spotify accounts were hacked. Someone tried to buy an iPad on eBay but I spotted it in time. Some of my hacker’s musical choices actually weren’t that bad! All happened shortly after the data breach but who knows whether they were linked and I guess could have been much worse.
    I did have a look at the SPG link and stupidly gave my number. I was inundated with texts and calls afterwards that, quite frankly, put me off. I decided not to pursue it.
    I’ve got a very good status with BA and I suppose I also didn’t want to jeopardise that.

    • Paul Pogba says:

      6 Jul6 July 09:09

      I think we’re in an age where you should use a different password for every business you deal with so if anything is hacked or leaked it ringfences the damage. I use a separate alias email address for BA now that only they have been issued so if it ever ends up on the dark web I’ll know its a result of their shoddy work.

      • Nick says:

        6 Jul6 July 10:08

        Agreed – if you have a gmail or hotmail/outlook account, you can also use a different email alias and password for each account by using the + symbol, with all emails going to the same address. ie myemail+headforpoints@gmail.com will be delivered to myemail@gmail.com.

        This, coupled with a different password per account and two factor authentication, is the only way to mitigate most of the opportunistic hackers.

        Probably over the top, but having had multiple accounts breached using credential stuffing, this is something I now adopt.

  • Chris Heyes says:

    6 Jul6 July 08:58

    Ian I Agree tongue in cheek there should be no compensation if BA or any other Airline fail to get you to your destination You should just take the loss on the chin
    Why should they have to give you your flight money back
    After all it’s not the Airlines fault you couldn’t get into the country lol

  • Paul Pogba says:

    6 Jul6 July 09:07

    I didn’t join because I’m not one for kicking somebody when they’re down (and because I have an Avios balance I don’t want to lose) but there is only so long you can give any company the benefit of the doubt. *IF* there has been another breach and my details are involved I will have lost patience. I’ve never killed (or even harmed) anyone when I speed but that doesn’t mean I shouldn’t be fined if I’m ever caught or that I shouldn’t avoid doing it in the first place.

  • Claire says:

    6 Jul6 July 09:39

    I can .. I cancelled the holiday I had booked during the breach and I asked BA to refund me but they refused. I didn’t trust the original information that the travel details had not been stolen and I was correct to not trust. BA were adamant they were not going to refund me and showed complete disregard towards my situation, so I for one did absolutely feel justified in joining the action.

  • Andy says:

    6 Jul6 July 09:41

    I did sign up at the start (although I wouldn’t now after the troubles BA have been through)

    I was really annoyed how they dealt with me at the time. My card details were in the breach and BA admitted that. I had a fraudulent purchase pop up on my phone a month or so later for a substantial amount of money. I had to spend two hours on the phone at a close friend’s 40th birthday party sorting it out. I was then without my card for three weeks due to going on holiday. I missed out on around 2000 Avios of spend during that time. Not the end of the world. But I got in touch with BA and explained the situation: I asked for a goodwill gesture of half the avios I was missing. There refused and then I got the email about signing up for the class action so I did.

    If BA had just thrown me 1000 Avios I’d have gone away at the start

    • Yuff says:

      6 Jul6 July 09:59

      I think I may have had an email but like others I don’t like this money for nothing culture. I am fairly sure if they had used my details the card company would have refunded me and I remember cancelling some cards as well.
      A little bit inconvenient, yes, but worth £500 £2k no.
      I don’t agree with ambulance chasers and this is just another scheme like that.

  • Ben says:

    6 Jul6 July 15:53

    I am a claimant, and I also work in information security. The reason I signed up to this litigation is that BA were completely unresponsive to my followup requests for more information, utterly unapologetic, and stonewalled requests for reasonable compensation.

    Their foolish cost-cutting put me and my family in harm’s way because of my work, and I want to take every possible step to make sure they learn from this lesson, in particular to stop outsourcing mission-critical IT to the cheapest bidder.

    • Brian W says:

      6 Jul6 July 23:35

      How exactly were your family put in ‘harms way’ by your card data being breached @Ben?

• Andrew says:

  6 Jul6 July 07:35

  So presumably there will be lots of other law firms going after this now so we can sign up with one of those.

• TimM says:

  6 Jul6 July 07:44

  I would have thought it would have been better for BA to let it go to court as the court had imposed a deadline for those affected to join the case. Now it appears both open-ended and inviting others to jump on the bandwagon. We shall see what emerges, or maybe we won’t?

  • JDB says:

    6 Jul6 July 08:25

    There isn’t a bandwagon worth jumping on. Any sum received will be de minimis as the ‘victims’ of which I was one have in reality suffered nothing and to the extent any ‘victim’ could prove actual loss they would have been paid out in full a while ago. We don’t have punitive damages in England in the same way as the US. The purpose of the court process is to put the claimant back into the position they would have been if the breach had not occurred.

    • Peter Ould says:

      6 Jul6 July 09:40

      This is not quite true. Since Vidal-Hall vs Google, UK courts (certainly English and Welsh ones) have seen damages for data protection breaches being not limited to just the fiduciary loss. Certainly it wouldn’t run into tens of thousands (in the way that US punitive claims do), but a sum around £1000 is not unreasonable even if no actual fraud was committed on the card (and if it was, then more).

      I would anticipate a sum in the top end of three figures, minus 30% for expenses. Coming away with £500 or more would seem a reasonable expectation (and in my case it’s all going to the local foodbank).

      • RussellH says:

        6 Jul6 July 11:21

        As someone who issues foodbank vouchers, a big thank you for donating!

        • Peter Ould says:

          6 Jul6 July 13:58

          We had a very successful year at work and we did share the fruits of that over the winter.

This article is closed to new comments. Feel free to ask your question in the HfP forums.