Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
EasyJet disclosed on 19 May 2020 that an attacker had accessed the email addresses and travel details of approximately 9 million customers. A smaller group of 2,208 customers also had payment-card details accessed. The incident led to regulatory scrutiny and private group actions, but the available records do not establish a final GDPR infringement ruling, a settlement, or compensation for affected customers.
What data was accessed in the easyJet breach?
In its 19 May 2020 announcement, easyJet said the attacker had accessed email addresses and travel details for approximately 9 million customers. The company said passport and credit-card details were not accessed for that broad group, with one important exception: payment-card details for 2,208 customers were accessed.
The 2,208 card-detail cases are a subset with a different, more sensitive data category; they should not be conflated with the approximately 9 million customers whose email and travel details were accessed. The announcement date is when easyJet publicly reported the incident, not necessarily when the attack began.
What did easyJet say about misuse and phishing?
At the time of its announcement, easyJet said, “There is no evidence that any personal information of any nature has been misused.” That was the company’s account of what it knew on 19 May 2020; it does not establish that misuse never occurred later. EasyJet said it had contacted customers whose card details were accessed and would notify the broader affected group. It advised customers to be alert for unsolicited communications and potential phishing.
#1 Best Overall
Chief Executive Officer Johan Lundgren said in the same announcement that, amid heightened concern about online scams during COVID-19, easyJet was contacting customers whose travel information had been accessed and advising them to be extra vigilant with unsolicited communications.
Did the ICO find that easyJet violated GDPR?
The available records do not show a published finding either that easyJet infringed GDPR or that it did not. An easyJet filing says the Information Commissioner’s Office (ICO) de-prioritised its investigation on 17 August 2023 and that the company considers the case closed. EasyJet’s financial-year 2025 results likewise describe the ICO investigation as closed.
The ICO’s Freedom of Information response says the investigation had been de-prioritised. It also explains that some investigation-related information was withheld under exemptions covering regulatory functions and the decision outcome, and says the investigation could potentially be reopened. Accordingly, closure or de-prioritisation is not proof of either an exoneration or a GDPR violation.
What is the status of the easyJet group actions?
EasyJet’s financial-year 2025 results say associated group actions by law firms representing affected customer classes “remain in place.” The company also reports that other claims have been commenced or threatened in other jurisdictions. It says the claims’ merits, likely outcome, and potential impact remain significantly uncertain; it could not assess likely outcome or value and made no provision in its financial statements.
Bingham Long’s case page, in an update dated 1 November 2025, says its easyJet action is “closed to new claimants” and that “the litigation is ongoing.” That statement describes that firm’s action at the date of its update; it does not establish the status or intake position of every claim.
The ICO process and private group actions are separate. The regulator’s investigation status does not decide the outcome of the group litigation. The sources cited here do not establish a final court judgment, settlement, compensation total, claimant count, or current court timetable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
