Due to a break in the airline’s security system last year leaking user’s personal data, British Airways faces a record fine of €183 million, or $203 million. This is the largest financial penalty of its kind and the first made public under the new regulations.

The security breach to BA’s system occurred when users were diverted from the airline’s website to a fraudulent site, where users’ names, email addresses and credit card information, including the expiration dates and CVV data, were stolen. The security breach did not include passport details or travel information, but about 500,000 customers were affected.

The theft was disclosed to travelers and the public Sept. 6, 2018, but was believed to have actually begun sometime in June 2018.

The record-breaking fine is the first under the new General Data Protection Regulation plan and totals approximately 1.5 percent of British Airways’ €11.6 billion ($13 billion) in revenue last year.