British Airways Class Action Lawsuit Alleges Poor Security Practices

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

A British Airways class action lawsuit says the company failed to appropriately protect details such as email addresses, names, billing addresses, and full credit card details of customers who made a purchase with the airline.

Lead plaintiff Ralph Pena filed the British Airways class action lawsuit on behalf of himself and other affected consumers who could be at risk of identity theft.

The British Airways class action lawsuit says that the plaintiff first learned about the exposure of his personal information on Sept. 6, 2018.

At that point, the lead plaintiff and other putative Class Members discovered that in August 2018, their information was stolen from the British Airways database.

As argued in the British Airways class action lawsuit, the breach and access of customer data was directly caused by improper security protocol on the part of the airline, leaving that personal information exposed to the risk of hackers.

The British Airways class action lawsuit says that the information for hundreds of thousands of consumers was thereby leaked during the security breach.

Pena claims that British Airways knowingly violated many of the common best practices in the industry to protect this kind of information, but instead chose to cut corners and leave this data exposed to a high hacking risk that ultimately came to fruition in August 2018.

The plaintiff in the British Airways class action lawsuit lives in New York and regularly travels with airlines in the Oneworld Alliance, which includes British Airways. He says he used his credit card to buy a plane ticket on Sept. 1, 2018.

Pena says he was notified shortly after that by Citibank, his credit card company, about a suspicious purchase totaling $1,000. He claims that his credit card was canceled during the trip he booked with British Airways, blocking him from being able to accrue his reward points as he intended to do.

The plaintiff in the British Airways class action lawsuit also used a separate credit card to change his dates on another ticket on July 1, 2018.

More than 20 unauthorized Uber rides were charged to that card in August, at which point the plaintiff canceled the card. Pena says he planned to use that card to accumulate rewards points as well and was unable to do so.

The British Airways class action lawsuit says that hackers used only 22 lines of code to breach the security system and gain access to customer’s credit cards captured by the company’s mobile app.

The lawsuit seeks to represent a nationwide Class of all persons in the U.S. who used the mobile application or website of British Airways to make a purchase, change a travel ticket, or make a payment between Aug. 21, 2018 and Sept. 5, 2018.

The British Airways class action lawsuit also seeks to represent a New York subclass.

The proposed Class is represented by Gary S. Graifman and Jay Brody of Kantrowitz Goldhamer & Graifman PC, and by Nicholas Migliaccio and Jason Rathod of Migliaccio & Rathod LLP.

The British Airways Data Breach Class Action Lawsuit is Ralph Pena v. British Airways PLC, Case No. 1:18-cv-06278, in the U.S. District Court for the Eastern District of New York.