Capita hit with £14m fine for personal data breach in 2023 cyber attack

The Information Commissioner’s Office has fined Capita plc and Capita Pension Solutions Ltd a combined £14m after a 2023 cyber attack that saw hackers gain access to over 6m people’s data. The breach, described as occurring in March 2023, included information such as pension details and staff records, as well as details of customers of organisations Capita supports, with some cases exposing sensitive data including criminal records, financial data or so-called special category data.

The ICO’s notice records that the initial proposed fine of £45m was reduced as part of a voluntary settlement and in light of Capita’s actions to improve systems, offer support to those affected and engage with cyber authorities and regulators. Stroud News & Journal is cited in the piece as the source for the £14m figure and the scope of the breach. The fine marks a notable enforcement outcome for a large outsourcing group following a high-profile data incident.