The ICO has fined Marriott International Inc £18.4million for failing to keep millions of customers’ personal data secure. Marriott estimates that 339 million guest records worldwide were affected following a cyber-attack in 2014 on Starwood Hotels and Resorts Worldwide Inc. The attack, from an unknown source, remained undetected until September 2018, by which time the company had been acquired by Marriott.

The personal data involved differed between individuals but may have included names, email addresses, phone numbers, unencrypted passport numbers, arrival/departure information, guests’ VIP status and loyalty programme membership number.

The precise number of people affected is unclear as there may have been multiple records for an individual guest. Seven million guest records related to people in the UK.

The Information Commissioner’s Office (ICO) has fined British Airways (BA) £20m for failing to protect the personal and financial details of more than 400,000 of its customers. The cyber-attack is believed to have potentially accessed the personal data of approximately 429,612 customers and staff. This included names, addresses, payment card numbers and CVV numbers of 244,000 BA customers. Other details thought to have been accessed include the combined card and CVV numbers of 77,000 customers and card numbers only for 108,000 customers. Usernames and passwords of BA employee and administrator accounts as well as usernames and PINs of up to 612 BA Executive Club accounts were also potentially accessed.

The Information Commissioner’s Office (ICO) has fined Cathay Pacific Airways Limited £500,000 for failing to protect the security of its customers’ personal data. Between October 2014 and May 2018 Cathay Pacific’s computer systems lacked appropriate security measures which led to customers’ personal details being exposed, 111,578 of whom were from the UK, and approximately 9.4 million more worldwide.

The Information Commissioner’s Office (ICO) has fined a London estate agency £80,000 for leaving 18,610 customers' personal data exposed for almost two years. The security breach happened when Life at Parliament View Ltd (LPVL) transferred personal data from its server to a partner organisation and failed to switch off an Anonymous Authentication function. This failure meant access restrictions were not implemented and allowed anyone going online to have full access to all the data stored between March 2015 and February 2017. The exposed details included personal data such as bank statements, salary details, copies of passports, dates of birth and addresses of both tenants and landlords

The Information Commissioner’s Office (ICO) has fined a London-based pharmacy £275,000 for failing to ensure the security of special category data. Doorstep Dispensaree Ltd, which supplies medicines to customers and care homes, left approximately 500,000 documents in unlocked containers at the back of its premises in Edgware. The documents included names, addresses, dates of birth, NHS numbers, medical information and prescriptions belonging to an unknown number of people.

On 19th May 2020, EasyJet confirmed that it had been the target of a highly sophisticated hack. Over nine million customer details were lost in data breach such as email address and travel information. Financial information (credit card details including CCV) was stolen.

Dixons was fined £500,000 by the Information Commissioner’s Office (ICO) for failing to protect its customers. The Dixons Carphone Warehouse data breach resulted in 10 million customer records being accessed from Currys PC World and Dixons Travel stores. The details stolen by cybercriminals included names, addresses, contact details, Date of birth, email addresses. Cyber criminals were also able to access records of 5.9 million payments cards.

In 2017, poor security processes at Equifax led to a huge data breach. The ICO has fined Equifax £500,000.

In August 2019, over 750 annual benefit statements were sent to the wrong postal addresses. These statements were for police officers of Sussex Police. The data compromised in this breach included the following information, Name, NIN, Account Number, Salary, Member reference, DOB, Current pension details & Police service details.

In January 2021, London-based estate agent Foxtons discovered that it had experienced a huge data breach. Personal and financial information such as address and card details were compromised in this breach.

In February 2020, Loqbox suffered a cyber-attack where Personal and financial information such as address and card details were compromised in this breach.

In April 2020, The data breach affecting the UK’s largest cake franchise exposed online customers debit and credit card information, including 3-digit CVV codes, putting them at serious risk of financial fraud. An email has been sent to Cake Box customers who may have potentially been affected by the data breach.