A LAW FIRM is considering filing class action lawsuits against British Airways (BA), the BBC, Boots and DHL after a mass hack of workers’ personal data last month.

Leigh Day said today it was investigating data breach claims for up to 200 current and former employees of the companies, who were told that they had been affected by the attack.

Notorious Russian ransomware cyber group Clop hacked the personal details of many thousands of employees to sell on the black market, experts say.

Data breach claims specialist Sean Humber, a partner at Leigh Day, said: “This is a serious data breach. Clearly, for hackers to be able to access this personal data, something has gone badly wrong.  

“If it turns out that the security measures were not adequate, it is likely that those affected are to be entitled to compensation for the distress caused by the breach as well as any financial losses that they may have suffered.”

Hackers exploited a vulnerability in a widely used file transfer tool called MOVEit, supplied by Progress Software, to access organisations’ IT systems, the law firm said.

Payroll services company Zellis confirmed it was among those affected, through which the personal data of current and former employees of BA, BBC, Boots and DHL was accessed.  

Clop claimed on its darknet site that it had exploited vulnerabilities in the MOVEit software to download data from “hundreds of companies.”

It warned affected organisations to contact the hacking group to agree a ransom payment or it would start publishing the stolen data. 

With the deadline having now expired, Clop has started naming companies and posting stolen data.

To date, the hackers do not appear to have identified Zellis, BA, BBC, Boots or DHL, all of which were contacted for comment.