Lawyers given 15 months to build BA breach legal case

Lawyers have until January 2021 to convince up to 500,000 victims of the British Airways data breach to join a class action against the airline following a High Court ruling that customers are within their right to pursue their own legal battle.

However, despite a huge marketing blitz to lure those affected, disgruntled customers have hardly been falling over themselves to join legal action: 5,000 have signed for SPG Law, 1,000 have joined Hayes Connor and 230 have briefed Your Lawyers.

The issue first emerged in September last year, when BA issued a grovelling apology – and rushed out full-page press ads – after admitting its website had been hit by a major breach which lasted nearly a fortnight before being spotted.

The ensuing Information Commissioner’s Office investigation found that hackers had stolen details of 500,000 customers, including 380,000 bank details. Customer information which was compromised included name, billing address, email address and card payment information, including in tens of thousands of cases CVV security code.

The regulator then issued a “notice of intent” to fine the airline £183m, although BA is challenging the penalty.

At the time, BA chairman and chief executive Alex Cruz insisted that there was no evidence of any fraudulent activity on accounts linked to the theft. He added: “We are surprised and disappointed in this initial finding from the ICO. British Airways responded quickly to a criminal act to steal customers’ data.”

However, despite the little evidence of financial damage, lawyers are likely to use the breach as a test case for whether they can prove customers have suffered psychological injury or distress as a result of having their personal information compromised, and, if successful, could leave other brands wide open to huge compensation payouts.

While admitting “each case is different”, Hayes Connor says it expects to claim up to £5,000 per person, SPG Law is not quite so bullish, insisting claimants “could be eligible for up £2,000 or more”. However, others insist victims could receive as much as £16,000 each in cases where psychological injury is extreme, while average compensation payments for distress could reach £6,000.

In a statement Aman Johal, director of Your Lawyers, said: “[The] grant of a group litigation order is a key step towards justice for the hundreds of thousands of victims of the British Airways data breach scandal.”