In late March 2023, ransomware attackers entered Capita’s systems, exfiltrated client and employee information, and disrupted internal IT services for weeks. The British outsourcing company served hundreds of organisations, including pension providers and public-sector clients. A privileged service account, “CAPITA\\backupadmin,” held domain-administrator rights without adequate restriction or monitoring. Three penetration tests conducted between August 2022 and early 2023 had identified the configuration as a vulnerability, but Capita did not fix it before the intrusion. The incident forced password resets for 59,000 accounts and generated at least 90 breach notifications to the UK Information Commissioner’s Office (ICO) by May 2023.
The ICO later concluded that data relating to approximately 6.6 million people had been exfiltrated, including health and criminal-record information. The breach produced 93 formal complaints to the ICO, 678 complaints to Capita, recovery and remediation costs exceeding £25 million, and a High Court group action brought by Barings Law for more than 8,000 claimants. On 10 October 2025, Capita and Capita Pension Solutions admitted UK GDPR infringements and agreed to a voluntary settlement. The ICO imposed a combined £14 million penalty—£8 million on Capita plc and £6 million on CPSL—after finding failures to implement appropriate security measures. In February 2026, the High Court allowed the group action to proceed.
