Back in June 2023, British Airways (BA) staff were told that their personal data had been exposed in a serious cyber-attack. Fast forward two years, and many affected employees still haven’t taken steps to claim the compensation they may be owed.
If you worked for BA and were paid through its UK or Irish payroll systems, your data could have been compromised in the breach, and it’s not too late to take action.
What happened in the British Airways employee data breach?
In mid-2023, BA confirmed that a third-party supplier, Zellis, had experienced a data breach. Zellis handled payroll services for BA and used a file transfer tool called MOVEit, which hackers exploited using a previously unknown vulnerability.
For BA employees, it meant highly sensitive payroll data was exposed to cybercriminals.
The breach didn’t just affect BA. Several large companies were caught up in it including Boots and the BBC.
What data was accessed?
If you were affected, the data taken could have included:
- Your full name
- Home address and work email
- Date of birth
- National Insurance number
- Bank account number and sort code
- Salary and reward details
- Other job-related information
In short, the kind of data that fraudsters love to get their hands on.
Who was behind it?
The Russian ransomware group Clop (C10p) was linked to the attack. Around the time of the breach, Clop claimed to have accessed data from “hundreds of companies” using MOVEit and warned that they would start leaking data if ransom demands weren’t met. Some stolen data has since been posted online.
How did BA respond?
BA informed affected employees, notified the Information Commissioner’s Office and National Cyber Security Centre, and offered a free Experian credit and web monitoring service for 12 months. They also encouraged staff to watch for suspicious activity on bank accounts and update passwords where necessary.
All of that was a start, but if your personal data was exposed due to poor cybersecurity measures, you may be entitled to more than just monitoring.
Why you can still claim in 2025
Even though the breach happened two years ago, your right to claim hasn’t expired. UK data protection law allows you to bring a claim within a reasonable timeframe, and two years is well within that window.
Many people didn’t take action at the time. But if you were contacted by BA in 2023 and told your data had been compromised, there’s still a strong chance you can join an ongoing BA staff group action claim.
Join the Claim connects consumers with SRA-regulated lawyers. Visit the claim page to check your eligibility if a claim is open with one of our trusted legal partners. If a group action has not yet been launched, you can register your interest and we’ll keep you informed if a partner firm decides to take a claim forward.
