Capita fined £14m for inadequate cybersecurity after breach exposes six million records

The UK outsourcing firm and government contractor Capita was fined £14 million by the Information Commissioner’s Office (ICO) after a cyber attack in March 2023 led to the theft of sensitive data affecting over six million people. Data stolen included pension records, details of criminal convictions, and other financial information. The ICO stated that Capita failed to secure processing of personal data and lacked appropriate technical and organizational measures to respond effectively. The company also delayed responding to a high-priority security alert by 58 hours, far exceeding the one-hour target, due to an understaffed security operations centre. This delay allowed a malicious file, downloaded accidentally by an employee, to remain active and exploited by attackers. Though affected individuals experienced anxiety and stress, the ICO highlighted broader trust issues arising from the failure of such a large company. Capita avoided a larger £45 million fine by admitting liability, improving its systems, supporting affected individuals, and cooperating with regulators and the National Cyber Security Centre (NCSC). CEO Adolfo Hernandez emphasized significant investment in cybersecurity transformation since the attack. The incident comes amid a 50% rise in major cyber attacks in the UK, affecting other notable companies. The ICO urges all organizations to invest in security controls, monitor for suspicious activity, and respond quickly to alerts to protect personal data.