Capita fined £14 million for failing to protect data of 6.6 million people after cyber-attack

In March 2023, outsourcing company Capita suffered a serious cyber-attack that led to the theft of personal data belonging to 6.6 million people, including pension records, financial data, home addresses, passport images, and even sensitive information such as criminal records. The UK’s Information Commissioner’s Office (ICO) fined Capita £14 million for failing to ensure proper security measures to protect this data, which left it vulnerable. Although the initial proposed fine was £45 million, it was reduced after Capita demonstrated improvements in cybersecurity, supported those affected, and cooperated with regulators, including the National Cyber Security Centre (NCSC). The attack started when a malicious file was accidentally downloaded on an employee device, with a delayed response allowing attackers to escalate privileges and move across systems, exfiltrating nearly one terabyte of data. Capita administers over 600 pension schemes, with 325 affected by the breach. The ICO criticized Capita for inadequate security responses and organizational failures, emphasizing the broader risk such lapses pose to public trust and data protection. Other major UK firms, like Co-op and Jaguar Land Rover, have also faced cyber-attacks recently, with National Cyber Security Centre confirming a rise in significant national cyber-attacks this year.