Capita Fined £14 Million After Data Breach Affected 6.6 Million People

Summary

In October 2025, the UK Information Commissioner's Office fined Capita plc and Capita Pension Solutions Limited a combined £14 million over data-security failures connected with a major 2023 cyberattack. The ICO said personal information belonging to approximately 6.6 million people was stolen. The compromised information included pension and staff records and, for some people, sensitive financial, criminal-record and special-category data. The regulator found failures in technical and organisational security measures, including weaknesses that enabled privilege escalation and lateral movement, inadequate responses to security alerts, and insufficient penetration testing and risk assessment. A high-priority security alert was generated shortly after the initial compromise, but the affected device was not quarantined for 58 hours. Capita acknowledged the ICO's decision and admitted liability under a voluntary settlement. Source: Information Commissioner's Office https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/10/capita-fined-14m-for-data-breach-affecting-over-6m-people/