Personal data breaches are security incidents that affect either the confidentiality, integrity or availability of personal data. In this post, we examine some of the largest data breach settlements ever reached in the UK.

We have also covered some high-profile US and global-based data protection breaches. While not strictly relevant to the UK due to regulatory differences, we wanted to show just how high these fines can go. As you will see, fines for data protection violations can range in the millions, if not billions, of dollars.

If, while reading this guide, you have any questions about what constitutes a personal data breach or have been affected by such an incident, please get in touch with our team today. You can reach an advisor at any time using the contact information given here:

• Call us on 020 8050 3051
• You can also contact us online by completing this form
• Or, you can open the live chat window on your screen now.

Browse Our Guide

1. What Are The Largest Data Breach Settlements In The UK?
2. What Are The Biggest Data Breach Settlements Outside The UK?
3. Read More About Data Breaches

What Are The Largest Data Breach Settlements In The UK?

The Information Commissioner’s Office (ICO), the UK’s public body for upholding information rights, has powers to investigate, reprimand and fine offending organisations for failure to adhere to data protection legislation; the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018. We have provided an overview to some of the largest data breach settlements in the UK here.

British Airways

British Airways was fined £20 million for a data breach that affected over 400,000 customers. This is the largest fine ever handed down by the ICO, although the final sum was much less than the £183 million they had originally intended to issue.

A massive cyber attack modified BA’s systems in 2018 to gain unauthorised access and steal the details of customers as they entered their personal and financial data. This included names and addresses, travel information and payment card details. This went on for a period of 2 months before BA became aware and notified the ICO.

It was found that BA had failed to implement sufficient security measures to prevent such incidents from occurring. You can read more about this in the ICO’s 2020-2021 annual report.

Source: https://www.bbc.co.uk/news/technology-54568784

Equifax

The ICO fined the consumer credit reporting agency Equifax £500,000 following a data breach in 2017 by sending a monetary penalty notice to Equifax.  This major data breach impacted up to 15 million UK citizens. This was on top of the almost $700 million (£561 million) Equifax agreed to pay US regulators after hackers exposed data in a huge incident, affecting 147 million people.

Equifax were warned that one of their databases were critically vulnerable to cyber attacks due to Equifax not providing suitable protections on their consumer credit check service. The vulnerability had been detected, and orders from Equifax security to patch the code. However, no follow-up checks were carried out, and the software remained unpatched. To make matters worse, much of the personal data was unencrypted. 

As well as the huge fines to both UK and US regulators, Equifax have been ordered to carry out annual audits and be subject to external security assessments every two years.

Source: https://www.bbc.co.uk/news/technology-49070596

Dixons Carphone

Dixons Carphone (DSG Retail Limited), trading as Carphone Warehouse and Currys PC World, was hit with a £500,000 fine following a cyber attack that affected at least 14 million people. Malicious software had been installed on over 5000 tills across the country and went undetected for 9 months between July 2017 and April 2018.

The attackers were able to harvest enormous volumes of personal data. Names and contact information, addresses and details of failed credit checks were all exposed. The ICO found that poor security arrangements as well as inadequate steps to protect customer data, were in clear violation of the Data Protection Act 1998. 

To find out if you can make a data breach claim for your own circumstances you can call our advisors. You can read about the £500,000 fine issued by the ICO here.

Source: https://news.sky.com/story/dixons-carphone-fined-after-hackers-targeted-14-million-customers-11904695

TalkTalk

The theft of the details of some 157,000 TalkTalk customers in October 2015 resulted in TalkTalk being fined the sum of £400,000. It was found that TalkTalk had both failed to update software from their takeover of Tiscali in 2009 and failed to take remedial action on vulnerabilities, which led to cyber attacks in 2015. 

The vulnerability allowed hackers to bypass the access restrictions. Failures within TalkTalk meant the problem went unresolved. The personal data of approximately 157,000 customers was stolen, including financial data such as bank account details of some 16,000 of those customers.

According to TalkTalk this attack cost them £42m and over 100,000 customers who left in the wake of their failings. You can read here how the ICO investigation into the TalkTalk cyber attack unfolded.

Source: https://www.bbc.co.uk/news/business-37565367

Interserve

Interserve is an outsourcing firm that was designated a “strategic supplier” to the UK government. Their clients included the Ministry of Defence. 

113,00 employees had their personal information stolen due to failures to put in place appropriate measures to prevent such cyber attacks from occurring. It was found that internal security systems failed to block a phishing email containing a virus that an employee inadvertently downloaded. Various personal information, including highly sensitive special category data regarding employees’ religious beliefs, ethnic origins and sexual orientation, was compromised.

An antivirus alert was not investigated, and multiple company accounts and systems were compromised. The attack also uninstalled the antivirus software and encrypted all current and former employees’ information. The ICO found that outdated software and protocols, combined with inadequate staff training, contributed to this major incident. 

Interserve Group Limited were fined a total of £4.4 million for their failings, with their application for a reduction denied after mitigating arguments presented were not deemed sufficient. A data breach of this kind could give rise to a claim for a data breach at work.

These 5 security incidents are some of the 5 biggest data breaches in the history of the UK. They show how when big organisations fail to implement sufficient security measures, unauthorised persons can gain access to huge amounts of user data.

What Are The Biggest Data Breach Settlements Outside The UK?

The biggest data breach fines issued in the US and around the world at first glance dwarf those issued in the UK. A contributing factor to this is the fact these numbers can be overall totals. They contain regulatory fines issued by the US Federal Trade Commission (FTC) or other foreign agencies, and the sums paid out in damages.

A US national or global operator will have considerably more customers than a firm operating nationally in the UK. This means significantly more people could be affected by the largest data breaches. We have provided this brief list of some of the largest data breach fines from outside the UK over the last decade.

Highest Data Breach Settlements Outside The UK

Facebook

Facebook were hit with a colossal $5 billion fine, making this the largest ever penalty issued by the FTC. Facebook’s mishandling of user information in the Cambridge Analytica scandal constituted a massive data breach. This brought about global outcry in 2019 and very public scrutiny. The case was eventually settled in court for $725 million.

Source: https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election

Source: https://www.bbc.co.uk/news/technology-64075067

Didi Global

The Chinese government issued vehicle hire and taxi platform Didi Global with a fine of 8 billion Yuan ($1.2 billion) after they were found to be engaging in repeat violations of data security and personal information protection laws. 

https://www.bbc.co.uk/news/business-62248513

Amazon

The Luxembourg National Commission handed down a fine of €746 million ($886 million) for violations of the EU’s GDPR.

Source: https://www.bbc.co.uk/news/business-58024116

Equifax

We discussed this in the above section, but it’s coming back for our global top 5. The $700 million fine brought against Equifax by the FTC for failing to protect the personal data of 147 million customers remains the 4th highest data breach fine ever issued in the USA.

Epic Games

The Fortnite creator agreed to pay a total of $520 million to settle fines issued by the FTC for violations of the Children’s Online Privacy Protection Act (COPPA) and for compensation for affected customers.

Source: https://www.bbc.co.uk/news/business-64030272

These are extreme examples of breaches of data protection and the penalties that can be imposed on organisations. They represent some of the largest data breaches in history, impacting millions of individuals. For more data breach examples, please see the resources below.

Contact Us

You can read our guide to the data breach claims process for more information or contact us. Our advisors are available to answer your questions at any time. They can potentially connect you to a No Win No Fee solicitor from our panel to help you with a claim. You can use the following details:

• Call us on 020 8050 3051
• You can also contact us online by completing this form
• Or, you can open the live chat window on your screen now.

Read More About Data Breaches

You can learn more about data breaches by browsing our website:

• Can you sue a company for a data breach?
• Learn how data breach compensation is calculated.
• How to sue someone for disclosing your personal information.

We have also provided these external resources for additional information:

• You can make a complaint to the ICO if you believe an organisation have mishandled your personal information.
• Read the data breach guidance for individuals and families from the National Cyber Security Centre here.
• See the Government’s tips for staying safe online on their website.

We’d like to thank you for reading this guide to the largest data breach settlements around the world.

A data breach claim calculator can be a very useful means of estimating the compensation you could be entitled to. But what exactly is a personal data breach? Who is responsible for such occurrences? How will I show what harm was caused by having my personal data disclosed without my permission? We’re going to cover all of these questions.

As well as explaining data breaches and providing some possible examples to help your understanding, we also cover key areas such as the time limits for claiming, how data breach claims are valued and what role the Information Commissioner’s Office (ICO), the national body for the upholding of information rights, play when it comes to holding organisations accountable for violations of data protection law.

We also explain how our panel of expert data breach solicitors could help you claim compensation under a specific type of No Win No Fee contract.

For a free assessment of your eligibility or to ask any questions about the topics covered here, get in touch with our advisors via any of the following:

• Call the team on 020 8050 3051
• You can also contact us through our website by completing our call back form.
• Open the live chat window on your screen now.

Select A Section

1. Data Breach Claim Calculator
2. What Is A Data Breach?
3. How Could Data Breaches Happen?
4. What Could Help Me Make A Data Breach Claim?
5. How Long Do I Have To Claim For A Data Breach?
6. Why Claim Data Breach Compensation Using A No Win No Fee Solicitor?
7. Learn More About How To Make A Data Breach Claim

Data Breach Claim Calculator

There are two types of damage that you could receive compensation for following a successful data breach claim:

• Material damage refers to the financial impacts of a personal data breach. We’ll discuss this in greater detail below.
• Non-material damage is the psychological harm caused from your personal information being compromised. This can range from relatively general distress and anxiety to post-traumatic stress disorder in the most serious of cases.

Calculating a possible compensation figure is one of the many things the solicitors on our panel could help you with. When determining potential compensation for non-material damage, reference can be made to your psychiatric diagnosis alongside the Judicial College Guidelines (JCG).

The JCG is a publication that details guideline compensation figures for various injuries, taken as averages from court cases in England and Wales. We have used the guidelines for psychological harm in our data breach claim calculator, which you can use to get an idea of what compensation you could be entitled to in your particular circumstances.

Can I Claim For Material Damage Caused By A Data Breach?

Material damage refers the financial losses that stem from a personal data breach. As well as immediate costs, material damage also refers to ongoing and long term monetary impacts of having your personal data exposed.

What this means is material damage compensation can often be quite high. We have provided a few examples of material damage here:

• The cost of security measures such as cameras or full relocation should your address be accessed by unauthorised persons.
• Lost earnings from time taken off work to recover from the psychological distress.
• Medical costs such as prescriptions, therapy or other bills relating to the non-material damage caused.

In order to claim compensation for non material damage you will need to provide some supporting documentation, so make sure you hold onto copies of your payslips, prescription letters and other proof of the losses you incurred.

The information given in this section as well our compensation calculator are intended to act as guidance only. To get a more personalised idea of what your potential data breach claim could be worth, get in touch with our advisory team for a free consultation today.

What Is A Data Breach?

A personal data breach is defined by the ICO as an incident of security that affects the confidentiality, availability or integrity of personal information.

There are 3 relevant parties to any discussion about personal data breaches:

• The organisations that decide when, how and why your personal data will be processed are known as data controllers.
• Data controllers may use an external organisation to process data, referred to as a data processor, although not every data controller will do this.
• Finally, you have data subjects, who are the individuals to whom the personal data relates.

Under both the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, both data controllers and processors must keep your data safe. Failing to uphold these laws can lead to security incidents where you personal data is put at risk.

We provide some specific examples of potential data breaches in the next section. The general eligibility criteria are as follows:

1. The data controller or processor failed to abide by data protection law.
2. This failure resulted in a data breach in which your personal data was affected.
3. You suffered financial losses, psychological harm or both as a result of this.

What Are The Different Types Of Sensitive Or Personal Data?

Personal data refers to information that can be used to directly or indirectly identify a living individual. This can include data such as names, addresses and contact information, as well financial data such as bank and credit card information.

The UK GDPR categorises certain types of personal information as “special category data.” What this means is that the personal data is considered to be more sensitive in nature, and therefore requires higher standards of protection.

Data relating to health, racial identity, religious beliefs and membership of trade unions are all considered special category. To find out if you’re eligible to begin a data breach claim, or to learn more about using our data breach claim calculator, contact our advisors today.

How Could Data Breaches Happen?

A data controller or processor can fail to uphold their legal obligations in a number of different ways. We have given a few possible examples here, but this list doesn’t cover all possible scenarios. Talk to our advisors to discuss your particular circumstances further.

Potential examples of personal data breaches include:

• Inadequate staff training at your bank meant physical copies of documents containing your personal information were not destroyed and instead thrown out with other office waste paper. This resulted in your address and contact information being exposed to unauthorised persons.
• Failures to update cyber security measures by your employer resulted in large amounts of employee data being exposed during a cyber attack. Your HR records were exposed during this attack.
• Administrative errors in a family court resulted in a letter being sent to the wrong address, where your abusive ex partner still lived. The letter contained details of your new place of residence. This resulted in that partner gaining knowledge of the new address of your address and your child’s whereabouts.

You can get in touch with our advisors at any time to find out if you have a valid claim using the contact information provided above.

What Could Help Me Make A Data Breach Claim?

Having explained our data breach claim calculator and given a few examples of how a personal data breach could occur, this section looks at how you could prove what harm was caused by a personal data breach.

Possible evidence examples include:

• Communication from the data controller informing you a data breach has occurred. All data controllers are required to notify affected subjects as soon as possible if the rights and freedoms of those subjects have been put at risk. This could be done via email or written letter.
• Financial documents such as your payslips, receipts or invoices detailing what material damage you experienced.
• Medical diagnosis from a psychiatric professional confirming any psychological harm that was caused.
• The findings from any ICO investigation.

As a data subject you have the right to express concerns regarding the handling of your personal information at any time to the data controller. Following an unsatisfactory response or no response at all, you can issue a complaint to the ICO, who can then open an investigation.

While the ICO do not have the power to award compensation, any findings from their investigation can be used as evidence. For more information on the evidence that could be used in a data breach claim, call the number below today.

How Long Do I Have To Claim For A Data Breach?

Typically, the time limit for data breach claims is up to 6 years. However this can vary depending on the type of organisation the claim is being made against. For additional guidance on the time limits in data breach claims, talk to our advisors using the contact information given below.

Why Claim Data Breach Compensation Using A No Win No Fee Solicitor?

Having explained how a data breach claim calculator could be of use to you when deciding whether or not to pursue a claim, we want to take the time to talk about how our panel of expert data breach solicitors could assist you.

The solicitors on our panel can offer their services on a No Win No Fee basis under what is known as a Conditional Fee Agreement or “CFA” if you’re eligible to claim. A CFA means claimants enjoy substantial benefits including:

• No fees to pay for the solicitor to begin work on the case,
• No fees for this work during the actual claims process and,
• Finally, should the claim be unsuccessful, there will be no fees to pay for that work.

Should the claim succeed, you will receive a compensation award for the material and non material damage caused. The solicitor will take a percentage of this award as their success fee. Now, because solicitor’s success fees are restricted to a maximum of 25% by The Conditional Fee Agreements Order 2013, you know you will keep the majority of any payout you receive. 

To inquire further about our data breach claim calculator or for a free assessment of your eligibility to claim, talk to our advisors today. Our friendly team are available 24 hours a day, 7 days a week, using the contact information provided here:

• Call the team on 020 8050 3051
• You can also contact us through our website by completing our call back form.
• Open the live chat window on your screen now.

Learn More About How To Make A Data Breach Claim

You can read some of our other data breach claims guides here:

• Read our guide to claiming compensation after a social services data breach here.
• Find out more about making a passport data breach claim with this guide.
• Learn more about what a mortgage broker data breach is and who might be eligible to claim compensation.

We have also provided these external resources for additional information:

•  See the NHS guidance on stress, what you can do to help alleviate it and what support can be made available.
• Read the Government’s latest Cyber Strategy on their website.
• You can view the guidance on data breaches from the Nation Cybersecurity Centre here.

Thank you for reading this post on using a data breach claim calculator. To learn more about data breach compensation, or to find out if your eligible to claim, contact our advisors today using the contact information provided above.