Cathay Pacific Airways Limited – €585,000 Fine (United Kingdom, 2020)

The airline’s failure to secure its systems resulted in the unauthorised access to their passengers’ personal details including: names, passport and identity details, dates of birth, postal and email addresses, phone numbers and historical travel information. Cathay Pacific became aware of suspicious activity in March 2018 when its database was subjected to a brute force attack, where numerous passwords or phrases are submitted with the hope of eventually guessing correctly. The incident led Cathay Pacific to employ a cybersecurity firm, and they subsequently reported the incident to the ICO. The ICO found Cathay Pacific’s systems were entered via a server connected to the internet and malware was installed to harvest data. Several errors were found during the ICO’s investigation including: back-up files that were not password protected; unpatched internet-facing servers; use of operating systems that were no longer supported by the developer and inadequate anti-virus protection. Although ICO considered that the contraventions were not deliberate, ICO held that they were negligent, as Cathay Pacific ought reasonably to have known that the contraventions would both (i) occur and (ii) be of a kind likely to cause substantial distress. ICO further held that Cathay Pacific failed to take responsible steps to prevent these contraventions. In reaching this view, ICO has had regard in particular to: the fact that in many instances Cathay Pacific was failing to follow its own policies; the fact that the best practices which were ignored were so fundamental; the availability of knowledge about the various vulnerabilities, whether via CVE or via notice from the service provider; and the fact that available controls were not implemented timeously or at all. Although Cathay Pacific acted promptly and forthrightly since it became aware of the data breach, ICO reached the view that it was appropriate to issue a monetary penalty of GBP 500.000, given the following aggravating features: awareness on behalf of the data controller of risks posed by its own omissions, considering the long duration of the breach (3 years and 7 month), lack of best practice in retaining data following the breach, failure to chose the most secure technical settings, failure to efficiently control access to personal data, failure to apply most secure anti-virus/malware technology, failure to keep devices up to date.