EasyJet disclosed in May 2020 that an attacker had accessed the email addresses and travel details of approximately 9 million customers. Payment-card details were accessed for a smaller group of 2,208 customers. The incident led to regulatory scrutiny and private group actions, but the available records do not establish a final finding of GDPR infringement, a settlement, or compensation for affected customers.
What happened in the EasyJet data breach?
On 19 May 2020, easyJet announced that an attacker had accessed information belonging to approximately 9 million customers. The broad affected group’s data included email addresses and travel details. EasyJet said passport and credit-card details were not accessed for that group, with one important exception: payment-card details were accessed for 2,208 customers. EasyJet’s announcement gives these figures; 19 May is the date the incident was publicly announced, not necessarily when the attack began.
As an Amazon Associate I earn from qualifying purchases.
| Affected group | Data easyJet said was accessed |
|---|---|
| Approximately 9 million customers | Email addresses and travel details |
| 2,208 customers | Payment-card details |
EasyJet said it had contacted customers whose card details were accessed and would notify the broader affected group. Those figures describe different data categories: the 2,208 card-detail cases are a smaller subset, not an additional group to add to the approximately 9 million.
What did EasyJet say about misuse and phishing?
In its 19 May 2020 notice, easyJet said there was “no evidence that any personal information of any nature has been misused.” That was the company’s statement about what it knew at the time; it does not establish that misuse could never occur later. EasyJet advised affected customers to watch for unsolicited communications and potential phishing.
#1 Best Overall
CEO Johan Lundgren said in the same announcement that, “owing to COVID-19 there is heightened concern about personal data being used for online scams.” He said the company was contacting customers whose travel information had been accessed, on the ICO’s recommendation, and advising them to be extra vigilant, particularly about unsolicited communications. The company notice contains his statement and the contemporaneous warning.
What did the ICO investigation establish?
EasyJet’s 2023 filing says the Information Commissioner’s Office (ICO) de-prioritised its investigation on 17 August 2023 and that easyJet considers the case closed. EasyJet’s financial-year 2025 results also describe the ICO investigation as closed. The 2023 filing and the FY2025 results establish easyJet’s account of that status.
The ICO’s response to a Freedom of Information request says the investigation had been de-prioritised. It also explains that some investigation-related information was withheld under FOIA exemptions, including information related to regulatory functions and the decision outcome; the ICO said the investigation could potentially be reopened. The ICO response does not publish a merits finding that GDPR was infringed or a finding that it was not. Administrative closure or de-prioritisation should not be mistaken for either a violation ruling or an exoneration.
Where does the EasyJet lawsuit stand?
The regulator’s process and private litigation are separate. In its FY2025 results, easyJet says group actions brought by law firms representing affected customer classes “remain in place”; it also says other claims have been commenced or threatened in other jurisdictions. The company says the claims’ merits, likely outcome and potential impact remain significantly uncertain, that it cannot assess likely outcome or quantum, and that it made no provision for them in its financial statements. This is the latest primary company disclosure identified here; it does not report a final judgment or settlement.
Bingham Long’s case page, in an update dated 1 November 2025, says its EasyJet action is “closed to new claimants” and “the litigation is ongoing.” That is the firm’s statement about its own action at that date, not proof of the status or intake arrangements of every claim. Bingham Long’s case page does not establish a current court timetable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is not yet established?
The available company and law-firm statements do not establish the precise procedural stage of each group action, a next hearing date, a final claimant count, or the outcome of each claim. They also do not establish a final court ruling on GDPR liability, a settlement, a total compensation figure, or payments to affected customers. EasyJet’s FY2025 disclosure specifically describes the claims’ outcomes and value as uncertain.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
