British Airways is facing a record fine of £183m for last year's breach of its security systems.
The airline, owned by IAG, says it is "surprised and disappointed" by the penalty from the Information Commissioner's Office (ICO).
At the time, BA said hackers had carried out a "sophisticated, malicious criminal attack" on its website.
The ICO said it was the biggest penalty it had handed out and the first to be made public under new rules.
The ICO said the incident took place after users of British Airways' website were diverted to a fraudulent site. Through this false site, details of about 500,000 customers were harvested by the attackers, the ICO said.
Information Commissioner Elizabeth Denham said: "People's personal data is just that - personal. When an organisation fails to protect it from loss, damage or theft, it is more than an inconvenience.
BBC
Russia's unmanned Luna-25 spacecraft has crashed into the Moon after spinning out of control, officials say.
Donald Trump has confirmed that he will not take part in Republican presidential debates with his rivals in the race for the White House.