The Information Commissioner’s Office (ICO) has issued a fine of £14m to Capita for failing to ensure the security of personal data related to a breach in 2023 that saw hackers steal millions of people’s information.
The ICO's investigation found that Capita had failed to ensure the security of processing of personal data, which left it at significant risk, as well as lacking the appropriate technical and organisational measures to effectively respond to the attack.
The ICO initially informed Capita of its provisional intention to fine it a combined total of £45m.
However, Capita then submitted representations and mitigating factors on the provisional decision, including the improvements made after the attack, support offered to affected individuals and engagement with other regulators and the National Cyber Security Centre.
As a result, the ICO and Capita have agreed to a voluntary settlement, with Capita acknowledging the ICO’s decision and admitting liability, and agreeing to pay a final penalty of £14m without appealing.
Capita plc has been fined £8m and Capita Pension Solutions Limited has been fined £6m.
The cyber attack took place in March 2023, with the personal information of 6.6 million people stolen, from pension records and staff records to the details of customers of organisations Capita supports.
According to the ICO, the attack began when a malicious file was unintentionally downloaded onto an employee device on 22 March 2023.
Despite a high-priority security alert being raised within 10 minutes of the breach and some immediate automated action being taken, the ICO found that Capita did not quarantine the device for 58 hours, during which the attacker was able to exploit its systems.
This file enabled the deployment of malicious software onto the Capita network, allowing the hacker to stay in the system, gain administrator permissions and access other areas of the network. Between 29 and 30 March 2023, nearly one terabyte of data was exfiltrated.
On 31 March 2023, ransomware was deployed onto Capita systems and the hacker reset all user passwords, preventing Capita staff from accessing their systems and network. The ICO received at least 93 complaints in relation to this attack.
The ICO's investigation also highlighted key areas where organisations should be taking proactive steps to reduce security risks.
This included following National Cyber Security Centre (NCSC) guidance on preventing lateral movement and ensuring that the ‘principle of least privilege’ is applied across the organisation, as well as regularly monitoring for suspicious activity and responding to initial warnings and alerts in a timely manner.
It also encouraged organisations to share the findings from penetration testing across the whole organisation so risks can be universally addressed, and to prioritse investment in key security controls to ensure that they are operating effectively.
Commenting on the news, UK information commissioner, John Edwards, said: “Capita failed in its duty to protect the data entrusted to it by millions of people. The scale of this breach and its impact could have been prevented had sufficient security measures been in place.
“When a company of Capita’s size falls short, the consequences can be significant. Not only for those whose data is compromised – many of whom have told us of the anxiety and stress they have suffered - but for wider trust amongst the public and for our future prosperity. As our fine shows, no organisation is too big to ignore its responsibilities.
“Maintaining good cybersecurity is fundamental to economic growth and security. With so many cyber attacks in the headlines, our message is clear: every organisation, no matter how large, must take proactive steps to keep people’s data secure.
"Cyber criminals don’t wait, so businesses can’t afford to wait either - taking action today could prevent the worst from happening tomorrow.”
Recent Stories