Outsourcing giant Capita has agreed to pay a £14 million penalty as part of a settlement with the UK’s Information Commissioner’s Office (ICO) over a major data breach stemming from a March 2023 cyber attack.
The fine, which was reduced from an initial provisional intention of £45 million after Capita’s representations and mitigating factors, breaks down into £8 million for Capita plc and £6 million for its subsidiary Capita Pension Solutions Limited.
Capita has admitted liability, accepted the decision without appeal, and expressed regret for the incident.
Background on the Capita 2023 Cyber Attack
The breach began on March 22, 2023, when a malicious file was downloaded onto an employee device, triggering a high-priority security alert within 10 minutes.
However, the device wasn’t quarantined for 58 hours, allowing hackers to escalate privileges, deploy malicious software, and exfiltrate nearly one terabyte of data between March 29 and 30.
On March 31, ransomware was deployed, resetting all user passwords and locking staff out of systems. The attack targeted unsecured servers, exposing personal data processed on behalf of over 600 organizations, with 325 ultimately impacted.
Impact of the Capita Data Breach
The incident affected approximately 6.6 million individuals, including pension holders, staff, and customers of organizations supported by Capita. Exposed data included pension records, staff details, customer information, and in some cases, sensitive elements like criminal records, financial data, or special category personal data.
The ICO received at least 93 complaints related to the attack, with affected individuals reporting anxiety and stress. Capita contacted all potentially impacted parties following a forensic investigation and offered 12 months of credit monitoring through Experian, which over 260,000 people activated.
Capita has since invested heavily in cybersecurity, including new leadership, advanced protections, and a culture of vigilance. It also engaged with regulators and the NCSC post-incident.
Financial Implications for Capita ICO fine
Due to the penalty, Capita adjusted its 2025 free cash outflow guidance (before business exits) to £59 million–£79 million, up from £45 million–£65 million. However, the company expects to become cash positive by the end of 2025, with full-year guidance and medium-term targets unchanged.
