Capita Data Breach: Why the ICO Fined It £14 Million

The first alert fired within ten minutes. The infected device was not isolated for almost two and a half days. That gap is the heart of the Capita case.

By Siddharth ShankarUpdated October 11, 2026

Capita is a large outsourcing company that handles records for pension schemes, employers and public bodies. People often have a relationship with it without knowing. That is what made its 2023 breach reach so many who never chose it.

What happened

The ICO fined two Capita companies a total of £14 million, reduced from a provisional £45 million: £8 million for Capita plc and £6 million for Capita Pension Solutions Limited. The regulator announced the fine on October 15, 2025. Capita admitted liability and did not appeal, under a voluntary settlement.

According to the ICO, 6.6 million people had their information stolen in the attack. The data also affected 325 of the more than 600 organizations that Capita Pension Solutions processes data for.

How it worked

On March 22, 2023, a malicious file was downloaded onto an employee's device. A high-priority alert was raised within ten minutes, but the device was not quarantined for 58 hours, against a target of one hour. Between March 29 and 30, nearly one terabyte of data was taken. On March 31, ransomware was deployed and all user passwords were reset.

The attacker gained administrator permissions. The ICO found there was no tiering model for administrator accounts and that the weakness had been flagged at least three times without being fixed. It also found the Security Operations Centre was understaffed and had missed response targets for at least six months.

What was exposed

The stolen data included pension records, staff records and customer details. Some records contained criminal record information, financial data or special category data, which is a legally sensitive class of personal information.

Because Capita processes data on behalf of other organizations, the people affected often learned about the breach from their pension scheme or employer, not from Capita itself.

How it ended

For the people affected, the outcome is unsatisfying. The fine goes to the government, not to individuals. At least 93 complaints were received. The remedy Capita offered was 12 months of credit monitoring from Experian, which over 260,000 people had activated by the time of the announcement.

Information Commissioner John Edwards said: "Capita failed in its duty to protect the data entrusted to it by millions of people."

Key facts at a glance

• Fine: £14 million in total, down from a provisional £45 million
• People affected: 6.6 million
• Attack window: March 22 to March 31, 2023
• Alert to quarantine: 58 hours, against a one-hour target
• Data taken: nearly one terabyte
• Remedy offered: 12 months of Experian credit monitoring

What you can do

What the ICO release does not say

The release does not say who carried out the attack or how much of the data has been misused. It also does not list the pension schemes affected. For another UK supplier case, see the Advanced ransomware fine.

Why this case matters

The Capita case is a clear example of response speed. The attack did not begin with a stolen password or a complicated exploit. It began with one file on one device, and an alert fired quickly. What failed was what happened next. A one-hour target for quarantine became 58 hours, and in that time the attacker moved to administrator access and took nearly a terabyte of data.

For individuals the lesson is about concentration. When a single supplier handles records for hundreds of organizations, one weakness reaches many people at once, and most of them never signed up with that supplier.

The practical next step is similar for most people. Read up on what each type of breached data means, how to tell a real breach notice from a phishing message and what to do after your email appears in a breach, then review your own accounts. You can also try our free email exposure check.