British Airways plc

British Airways suffered a 2018 cyberattack in which attackers injected malicious JavaScript onto the BA website that harvested personal and payment card data of approximately 429,612 customers by redirecting users to a fraudulent site during the booking process. The ICO found BA's security measures were inadequate and that the attack could have been prevented with more robust controls including script integrity monitoring and multi-factor authentication. The fine was reduced from an initial notice of £183.39 million due in part to the economic impact of COVID-19 on the aviation sector.