Global Airlines (Top 40) · Airline (Europe, LCC) · Private litigation + Data breach
easyJet
Headline
Roughly nine million customers had data exposed, including credit card details for a subset, and the group claim that followed asserted potential damages of up to £18 billion (a claimant-side figure)…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Roughly nine million customers had data exposed, including credit card details for a subset, and the group claim that followed asserted potential damages of up to £18 billion (a claimant-side figure); no judgment or settlement has been publicly reported. The structural lesson easyJet illustrates best is timing: the gap between when an intrusion occurs, when the airline detects it, and when passengers are told is where all the actual consumer harm accumulates, because every day in that gap is a day you are not freezing a card you do not know was taken.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Case status. Private litigation; no sources are on file yet, so no legal tier is assigned.
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected; UK/EU jurisdiction applies (see British Airways row for the general GDPR fine framework that would also apply here).
Data sharing
MAJOR DATA BREACH with a POTENTIALLY MASSIVE (though still unresolved) damages claim: a confirmed breach exposed personal data; law firm PGMBM (formerly SPG Law) brought a group action in the English High Court (seeking a group litigation order), arguing claimants could each receive 'up to £2,000 or €2,000' — which PGMBM put at up to £18 BILLION (~$22 billion) in TOTAL POTENTIAL damages across ~9 million affected customers, though this is a plaintiff-side calculation of maximum theoretical exposure, NOT a confirmed judgment or settlement amount, and English law has historically been much less receptive to US-style class actions, making the ultimate outcome genuinely uncertain.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy easyjet.com/en/privacy-notice | Not fetched yet | NO (HTML only) |
| Terms of service easyjet.com/en/terms-and-conditions | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.