Maximise your Avios, air miles and hotel points

Legal fees in British Airways data breach case hit £1,000 to £3,400 per person

Links on Head for Points may support the site by paying a commission.  See here for all partner links.

People who signed up for the British Airways data breach lawsuit via PGMBM, the biggest of the law firms taking part, received their settlement notices yesterday.

We are not allowed to disclose the amount but it was peanuts compared to the huge sums that had been suggested. Here is a press story from January 2021 where one of the law firms involved is suggesting that claimants would receive ‘an average’ of £6,000, implying many would get more. Some chance.

What is not confidential is the bill run up by the lawyers. The size of this bill gives an indication of the scale of the damages it was assumed British Airways would pay, and implies that someone did seriously believe the £6,000 figure.

Legal fees in British Airways data breach case exceed £1,000 per person

The level of legal fees charged varies, oddly. I have seen a Category 1 letter, where there was evidence of fraud based on the leak, allocated over £3,400 of legal costs. Another person in Category 1 was allocated just £1,000.

For a Category 2A claim, where there was no proof that the accessed data was used, the legal fees seem to be around £1,100. On top of this, there were expenses of over £150.

Actual expenses were far higher. As we reported back in February, the lawyers lost a court case where they attempted to include the costs of their TV and social media advertising campaigns in their reclaimable expenses.

PGMBM claimed that it had spent £443,000 on advertising so far and intended to spend another £557,000 before the case was heard. At the High Court, Mr Justice Saini decided that this was general marketing expenditure and was not reclaimable from the client. You can read more in the Law Society Gazette here.

Luckily for claimants, their exposure to legal fees and expenses is capped at 35% of the compensation received.

Without going into numbers, 35% of the settlement amount – at least for those in Category 2 who could not prove that their data was stolen – isn’t going to make much of a dent in the £1,000 to £3,400 of legal fees once the third party expenses and the £1m advertising budget is paid. Those who signed up early were promised 100% of their settlement, meaning even less for the lawyers.

PGMBM did say that British Airways has made a ‘contribution’ to these costs so there may be some profit for the lawyers at the end of the day. It certainly isn’t a bonanza though.

British Airways may have played this right. It made a settlement offer which was a fraction of the numbers that had been banded around when the lawsuits were launched. There was a real risk that, if the case had gone to trial, the judge would have decided that BA’s offer was reasonable, that the lawyers should have accepted and that the case should be thrown out.

At the very least, the case would probably have proceeded with a final settlement being made at the offer BA suggested, and with the lawyers being saddled with additional legal fees.

At the end of the day, the case has not been a great result for anyone involved.

Looking at online comment elsewhere, you had people originally claiming they were taking part in the action “purely as a point of principle” before turning angry when it turned out that the proceeds were going to get them a weekend in a Holiday Inn rather than a week-long five star holiday. Meanwhile, BA is hit by a cash outlay at the same time as it has to decide whether to make more redundancies, or otherwise start paying staff not to work, as the end of furlough approaches next month.

In the meantime, keep an eye on your social media feeds for ads asking you to join the easyJet data breach case. A quick Google search for “easyjet data breach claim” brings up various firms claiming you can get £2,000 by signing up. I wouldn’t bet on it.


How to earn Avios from UK credit cards

How to earn Avios from UK credit cards (April 2025)

As a reminder, there are various ways of earning Avios points from UK credit cards.  Many cards also have generous sign-up bonuses!

In February 2022, Barclaycard launched two exciting new Barclaycard Avios Mastercard cards with a bonus of up to 25,000 Avios. You can apply here.

You qualify for the bonus on these cards even if you have a British Airways American Express card:

Barclaycard Avios Plus card

Barclaycard Avios Plus Mastercard

Get 25,000 Avios for signing up and an upgrade voucher at £10,000 Read our full review

Barclaycard Avios card

Barclaycard Avios Mastercard

Get 5,000 Avios for signing up and an upgrade voucher at £20,000 Read our full review

There are two official British Airways American Express cards with attractive sign-up bonuses:

British Airways American Express Premium Plus

30,000 Avios and the famous annual 2-4-1 voucher Read our full review

British Airways American Express

5,000 Avios for signing up and an Economy 2-4-1 voucher for spending £15,000 Read our full review

You can also get generous sign-up bonuses by applying for American Express cards which earn Membership Rewards points. These points convert at 1:1 into Avios.

American Express Preferred Rewards Gold

Your best beginner’s card – 30,000 points, FREE for a year & four airport lounge passes Read our full review

The Platinum Card from American Express

80,000 bonus points and great travel benefits – for a large fee Read our full review

Run your own business?

We recommend Capital on Tap for limited companies. You earn 1 Avios per £1 which is impressive for a Visa card, and the standard card is FREE. Capital on Tap cards also have no FX fees.

Capital on Tap Visa

NO annual fee, NO FX fees and points worth 1 Avios per £1 Read our full review

Capital on Tap Pro Visa

10,500 points (=10,500 Avios) plus good benefits Read our full review

There is also a British Airways American Express card for small businesses:

British Airways American Express Accelerating Business

30,000 Avios sign-up bonus – plus annual bonuses of up to 30,000 Avios Read our full review

There are also generous bonuses on the two American Express Business cards, with the points converting at 1:1 into Avios. These cards are open to sole traders as well as limited companies.

American Express Business Platinum

50,000 points when you sign-up and an annual £200 Amex Travel credit Read our full review

American Express Business Gold

20,000 points sign-up bonus and FREE for a year Read our full review

Click here to read our detailed summary of all UK credit cards which earn Avios. This includes both personal and small business cards.

Comments (144)

This article is closed to new comments. Feel free to ask your question in the HfP forums.

  • Andy says:

    I never expected much and I’m very happy with the outcome as a 2A claimant. I certainly didn’t expect £6k and didn’t see the tabloid article about it

    • Aso40 says:

      Exactly the same here. If anything, it was a fair bit higher than I expected.

    • Yorkieflyer says:

      I agree, I’m content and signed up to send a message with others to BA that they ought to pay some compensation if only token to customers whose data they were so careless with

      • Lord Doncaster says:

        This action also will incentivise BA to maintain their IT systems because if such a leak happens again then legal action will also come with it

  • Peter says:

    Can’t wait for the Facebook claim, ever since their leak I get 2-3 spam calls per day!

  • Matt says:

    All of Rob’s comments on this don’t seem to really match reality as far as I can see it. The expenses incurred as stated in the settlement letter were nearer £3000 per person. The costs agreed in court according to an earlier letter were less than £900. The settlement figure is being paid 100%, without costs being deducted.

    On the settlement front I was expecting a couple of hundred £, and slightly concerned I’d be signed up to restrictive legal agreement for £50 or something like that. In the end, if it was a long weekend in a holiday Inn that would do fine.

    • Matt says:

      And yes, I signed up on a point of principle – the principle that if there’s some money going I’d like it to be in my wallet

    • Rob says:

      Cat 1 has upto £3400 of costs from what I’ve seen. Only those who signed up very early got the ‘no fees’ deal.

  • FFoxSake says:

    Have any claimants been kicked out of BAEC yet?

    • sloth says:

      can’t wait for all the whining if that happens…

    • Tim says:

      At the time, this was the final straw for me. I started to ship some of my business to Star. Now the BA lounge in Newcastle has gone and Lufty have started FRA from NCL, plus more Star options at EDI including Turkish and the new IST, it’s only westbound I still used BA, and only to get to LHR to fly with AA – again, if capitalism was practised correctly BA wouldn’t be getting a penny of those AA flights but unfortunately they are.

  • Andrew says:

    I rather like this article.

    The data breach annoyed me, the significant increase in volume of scam calls, texts and emails following the breach annoyed me.

    The relentless spamming of “targetted” online lawyers ads annoyed me most of all though. I was left with the uneasy feeling that the stolen data had been laundered and sold to and used by advertising companies to target market the claim lawyers online advertising.

    Hopefully:-

    BA and other firms will take considerably more care with our data.
    The ASA will require Legal Firms to manage client’s expectations downwards.
    I’d also like to see the ICO dictate a compensation table for the victims of data loss. It would be so much easier if the individual and firm knew that each and every significant breach would result in a, say, £500 compensation amount payable to the customer. Quite frankly, I think the Banks who are forced to chase behind slack data controls of merchants also deserve at least £100 per card or account data disclosed too.

    I didn’t take part in the claims.

  • Russ says:

    The thing is you used to be able to claim yourself you’d get to keep all the money. You don’t need specialist knowledge all you need was proof that it happened and you got that when you received an email signed and dated from high vis jacket man himself admitting it, with a apology.

    Apologies but your patting yourself on the heads because they threw you a bone. The truth is they’ve kept your fillet steak.

    • Nick says:

      Obvious but pointless comment. You can apply for all types of immigration visas yourself too. Didn’t stop my educated friends from paying £000’s to “immigration specialists”.

      This was easy cash. Win win all round

      • Andy says:

        And there it is, free riding at its finest!

      • John says:

        In 2011 paying an immigration advisor £1000 would allow you to get an in-person appointment within a week, keep all your documents and get the decision within 1 day.

        If you didn’t you would have to post your documents and wait 2-3 months, or do something akin to what everyone here does at 1am 355 days before their intended flight (keep refreshing a screen and hoping for one of a very limited number of public appointments – most people failed and had to submit by post anyway)

        However in 2013 they changed the system so that the public could easily book appointments but I didn’t realise this until I had paid a lawyer £1000

    • Alex Sm says:

      This is a fundamental basis of any services in the economy. A person can fix their shoes, change their windows, apply for a visa or defend themselves in court but many prefer to ask professionals to do that because it saves them time and effort and guarantees a better result as professionals know what they are doing. Obviously their services cost money.

      A more annoying thing that BA did not pay a compensation automatically to all affected, making people jump through all these hoops with lawyers, claims, courts etc. They are too cheeky, and they have always been (same with covid refunds etc) trying to pocket customers’ money by all means. Therefore I have zero sympathy for BA…

      • Adam says:

        Totally agree. Will add that I wasn’t prepared to risk my own money fighting BA for 2-3 years on my own – even if the £6000 mentioned was the outcome 🙄

        My card was used fraudulently but in the weeks following the breach.

        I was placed in Cat 2a (although felt I should have been 1) and received more than expected.

    • Tim says:

      100% of nil is nil though. All BA offered as a goodwill gesture was a year’s subscription to a credit monitoring service. It took ambulance chasing lawyers to reach this outcome. As I have little time for lawyers in general, more often than in my line of work I find are swingers creating rules in government then rotating to private practice to capitalise on the burden of rules they’ve created, the ambulance chasing variety are only a piece of chewing gum away from the other bits of lawyer dirt stuck on the underside of my shoe 🙂

  • ken says:

    A few people seem triggered by this article.

    Don’t you fail to see the growth of spurious class action claims, is just a continuum of those who put a whiplash claim in when they really haven’t had any injury at all, or frivolous claims to an ombudsman on the basis that “it costs the bank £600 anyway”.

    Of course, if its just the ‘principle’, you’d probably rather the ICO stuck to the £180m fine rather than reducing it to £20m and seen no compensation for those that suffered no tangible loss.

    • Lord Doncaster says:

      It further incentivises BA to minimise the opportunities for hackers to gain access to their systems (something that BA had not ensured previously…)

    • Doug M says:

      Yes, I’d prefer that the ICO fine was suspended rather than reduced. BA have to suffer significant financial damage for their shoddy security and IT practices.
      Ambulance chasing lawyers don’t fix anything.
      Proper enforcement of EU261 and GDPR would see BA do far more to address things than cases like this.

      • ken says:

        Agree

        £20m fine plus £160m suspended would have been a far better incentive than fighting off the ambulance chasers.

        • PeterK says:

          I agree that spurious claims are bad, but i’d argue this wasn’t a spurious claim in this case, certainly not for those people whose data was in fact accessed and shared. So handling this purely through ICO fines (which go to the Treasury as far as I’m aware) rather than compensate the victims would seem an odd way to go. But I agree anyone who said they took part in this ‘as a matter of principle’ isn’t telling the truth.

  • Martin says:

    So many people seem to have signed up to teach BA a lesson..
    So if it wasn’t about money,
    I’m sure it’ll all be donated to charity and not some HI weekend.
    Will be some lucky charities out there unless charity begins at home for most.

    • Andy says:

      Yeah right…

      • Gruntfuttock says:

        Wow, my light breakfast reading at 0727hrs has extended to coffee break reading. I’ve a feeling I’ll be reading this at lunch. I’ve got a hedge to cut! 🌲🌲🌲

    • DJ says:

      I frankly won’t be donating a penny to charity and if people are so bothered about BA’s financial situation why don’t they volunteer to clean the BA club lounge toilets of a Saturday.

    • Adam says:

      Mine is going (has gone) straight back to BA as part payment toward a family holiday. (The circle of life if you will)😎

This article is closed to new comments. Feel free to ask your question in the HfP forums.

The UK's biggest frequent flyer website uses cookies, which you can block via your browser settings. Continuing implies your consent to this policy. Our privacy policy is here.