Capita ransomware attack

On 31 March 2023, the UK outsourcing and business-process giant Capita confirmed a cyber incident that turned out to be a Black Basta ransomware intrusion — one of the most consequential breaches in recent British corporate history given Capita's vast portfolio of government and pension-administration contracts.

What happened

Black Basta operators gained access to Capita's network on 22 March 2023. Capita's monitoring tooling raised a high-priority alert within 10 minutes, and some automated containment was triggered. But the company failed to quarantine the compromised device for 58 hours, during which the attackers moved laterally, escalated privileges, and exfiltrated data before deploying ransomware. Capita pulled portions of its infrastructure offline to contain the spread.

Impact

• Personal data of approximately 6.6 million people was compromised, including pension records, staff details, and customer data belonging to Capita's clients.
• Capita Pension Solutions, which processes data for over 600 pension schemes, reported that 325 client organisations were affected. Stolen data types included names, addresses, National Insurance numbers, bank details, passport and driving-licence scans, and criminal-record-check information.
• Capita reported direct response costs of about £25.3 million and said the attack contributed to a £106.6 million annual loss for 2023.

Regulatory action

On 15 October 2025, the Information Commissioner's Office (ICO) fined Capita £14 million — split between Capita plc (£8 million) and Capita Pension Solutions (£6 million) — for failing to ensure the security of personal data. The ICO had initially proposed a £45 million penalty, reducing it after Capita demonstrated post-incident security improvements, provided 12 months of credit monitoring to affected individuals, and cooperated with the investigation. The regulator highlighted the 58-hour delay in isolating the compromised device as a central failing.

Why it matters

Capita is woven into the fabric of UK public services — running pension schemes, local-authority back-office systems, and central-government contracts. The breach showed how a single outsourcer can become a systemic data-protection risk affecting millions of citizens who never chose to share data with it. The ICO's reasoning made detection-to-containment speed, not just prevention, an explicit regulatory expectation, with Capita's 58-hour window held up as the cautionary benchmark.