Capita Fined £14 Million After Data Breach Exposes 6.6 Million Users

Capita was fined £14 million by the Information Commissioner’s Office after a cyber attack in March 2023 exposed the personal information of 6.6 million people. The penalty was split £8 million for Capita plc and £6 million for its subsidiary Capita Pension Solutions Limited, with the breach affecting pension records, staff information, and customer details from more than 600 organisations.

The attack began when an employee downloaded a malicious file on 22 March 2023, and although a high-priority alert was raised within 10 minutes, Capita waited 58 hours to quarantine the infected device. Between 29 and 30 March, attackers stole nearly one terabyte of data, and on 31 March they deployed ransomware and reset all user passwords.

The ICO received at least 93 complaints, and its investigation found serious weaknesses in Capita’s security practices, including inadequate controls for administrative accounts and understaffed Security Operations Centre. The ICO originally planned a £45 million fine but reduced it after considering Capita’s response; affected customers were offered 12 months of free credit monitoring through Experian, with over 260,000 people activating the service. According to the Information Commissioner’s Office, organisations of all sizes must take cybersecurity seriously.