Capita Data Breach

Capita Data Breach

Capita is one of the UK’s largest outsourcing and professional services companies. Earlier this year, the business suffered two major data breaches, affecting millions of UK residents. Capita works with many public and private organisations and provides vital services for local councils, the UK military and the NHS.

The company handles the personal information of millions of people and administers the pension funds for a number of large firms, including the Royal Mail, Axa, PwC and the Universities Superannuation Scheme (USS), which is the main pension fund for universities in the UK.

What happened during the Capita data breaches?

Capita data hack – The first breach

In March 2023, Capita reported a cyber-attack. Its investigation found that unauthorised access began on or around 22 March and was interrupted on 31 March. The attack was allegedly carried out by Russian hackers.

Around 90 organisations were affected, including the Royal Mail, the NHS, AXA, the Universities Superannuation Scheme, the Ministry of Defence and the Royal Bank of Scotland. Capita administers pension funds for many of these bodies and acts as a data processor holding information for thousands of employees.

The Pensions Regulator (TPR) contacted more than 300 pension funds asking them to check whether their data had been stolen. Several confirmed they were affected. Data potentially accessed included names, addresses, dates of birth, National Insurance numbers and financial details.

In July, Capita admitted that some of its own employees were also impacted. Three months after the attack, staff were told their personal data including marital status, contact details, salary information and employment history had been compromised. Capita said it was taking “extensive steps” to recover and secure the data and had hired a consultant to ensure it was not sold on the dark web.

Capita data breach – The second breach

A second breach was announced in 2023, when it was reported that Capita had left benefits data files in publicly accessible storage. These files had not been protected by passwords since as far back as 2016. Several councils said they believed their data may have been compromised. The breach was allegedly caused by an exposed Amazon S3 bucket, a cloud-based service that allows businesses to store data online.

If an S3 bucket is not properly configured, anyone can access it, creating a significant security risk. The bucket used by Capita, which contained sensitive information, was allegedly left publicly accessible, allowing cybercriminals to steal the data. This reportedly included benefits information from local councils, such as names, addresses, dates of birth and National Insurance numbers.

The Capita data breaches could affect millions of UK pension holders, employees and people on benefits. If you have been affected, you could be entitled to compensation. Contact our team today to find out if you are eligible to make a claim and discuss the next steps.