British Airways (BA) faces the largest group claim ever made in U.K. legal history over a 2018 data breach that exposed the financial and personal details of more than 400,000 of its customers.

Last October, the Information Commissioner’s Office (ICO), the U.K.’s data regulator, fined BA £20 million (U.S. $26 million) for violations of the EU’s General Data Protection Regulation (GDPR)—the largest penalty it has ever imposed.

Neil Hodge is a freelance business journalist and photographer based in Nottingham, United Kingdom. He writes on insurance and risk management, corporate governance, internal audit, compliance, and legal...