ICO has announced that it is fining Cathay Pacific £500,000 – it’s the maximum fine under the 1998 Data Protection Act, as the breach took place pre-GDPR – for multiple data protection failings that left millions of customer records exposed.
In its statement, the ICO said that: “Between October 2014 and May 2018 Cathay Pacific’s computer systems lacked appropriate security measures which led to customers’ personal details being exposed, 111,578 of whom were from the UK, and approximately 9.4 million more worldwide” and that “A catalogue of errors were found during the ICO’s investigation”.
