Back in June 2023, British Airways (BA) staff were told that their personal data had been exposed in a serious cyber-attack. Fast forward two years, and many affected employees still haven’t taken steps to claim the compensation they may be owed.
If you worked for BA and were paid through its UK or Irish payroll systems, your data could have been compromised in the breach, and it’s not too late to take action.
What happened in the British Airways employee data breach?
In mid-2023, BA confirmed that a third-party supplier, Zellis, had experienced a data breach. Zellis handled payroll services for BA and used a file transfer tool called MOVEit, which hackers exploited using a previously unknown vulnerability.
For BA employees, it meant highly sensitive payroll data was exposed to cybercriminals.
The breach didn’t just affect BA. Several large companies were caught up in it including Boots and the BBC.
What data was accessed?
If you were affected, the data taken could have included:
- Your full name
- Home address and work email
- Date of birth
- National Insurance number
- Bank account number and sort code
- Salary and reward details
- Other job-related information
In short, the kind of data that fraudsters love to get their hands on.
Who was behind it?
The Russian ransomware group Clop (C10p) was linked to the attack. Around the time of the breach, Clop claimed to have accessed data from “hundreds of companies” using MOVEit and warned that they would start leaking data if ransom demands weren’t met. Some stolen data has since been posted online.
How did BA respond?
BA informed affected employees, notified the Information Commissioner’s Office and National Cyber Security Centre, and offered a free Experian credit and web monitoring service for 12 months. They also encouraged staff to watch for suspicious activity on bank accounts and update passwords where necessary.
All of that was a start, but if your personal data was exposed due to poor cybersecurity measures, you may be entitled to more than just monitoring.
Why you can still claim in 2025
Even though the breach happened two years ago, your right to claim hasn’t expired. UK data protection law allows you to bring a claim within a reasonable timeframe, and two years is well within that window.
Many people didn’t take action at the time. But if you were contacted by BA in 2023 and told your data had been compromised, there’s still a strong chance you can join an ongoing BA staff group action claim.
How to check if you’re eligible
We work with specialist lawyers investigating compensation claims for victims of data breaches.
Joining the claim is straightforward:
- Check your eligibility – Complete a quick online form to see if you qualify.
- Register your interest – If eligible, share a few more details.
- Join the claim – We’ll connect you with a regulated UK law firm if and when your case is ready to proceed.
It only takes a few minutes – and you’re under no obligation to go ahead.
If you received a notification from BA about the breach and haven’t yet claimed, it’s worth taking a few minutes now.
