Overview

• Under a voluntary settlement, the ICO split the penalty between Capita plc (£8m) and Capita Pension Solutions (£6m).
• The March 2023 breach affected about 6.6 million people and 325 pension clients, exposing pension and staff records and, in some cases, special category data.
• The ICO found a 58-hour delay in quarantining an infected device, an understaffed security operations centre, and no tiered admin controls, enabling privilege escalation and lateral movement.
• Attackers exfiltrated roughly 1 TB of data before deploying ransomware on March 31, with the Black Basta group later claiming the incident and leaking files.
• Capita says it has strengthened cybersecurity and will not appeal, while thousands of legal claims continue and 2025 free cash outflow guidance has risen to £59m–£79m from £45m–£65m.