ENKR

Capita cyber attack and data theft

Add to my breach check

Made public

What leaked19

Replaceable

  • Card CVV/CVC
  • Card number

Hard to replace

  • ID card image
  • Driver's licence number
  • Income, balances, loans, credit or other financial details
  • Passport number
  • Bank account number
  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data
  • Username

Permanent

  • Biometric data
  • Health information
  • National ID or tax number
  • Sexual orientation or preferences
  • Ethnicity, religion or political views
  • Date of birth
  • Full name
  • Biometric datafor some people · ICO
  • Card CVV/CVCdebit card CVV for some people · ICO
  • Card numbercredit or debit card number for some people · ICO
  • Health informationhealth information and medical numbers for some people · ICO
  • ID card imagepassport, driving licence and photo ID scans for some people · ICO
  • National ID or tax numberNational Insurance number
  • Sexual orientation or preferencessexual orientation, for some people · ICO
  • Ethnicity, religion or political viewsfor some people: ethnic origin, political and religious beliefs, trade union membership · ICO
  • Driver's licence numbertaken for some people only · ICO
  • Income, balances, loans, credit or other financial detailspension details for some people · ICO
  • Passport numbertaken for some people only; not every type was taken for each person · ICO
  • Bank account numberaccount number and sort code, or IBAN
  • Mobile numberphone number
  • Other profile datafor some people: criminal record checks, signatures · ICO
  • Usernameemployee login details

To-dos6 · about 1 h 30 min in all

  1. Have the card reissued with a new numberabout 15 minStops: card fraud online
  2. Turn on instant transaction alertsabout 5 minHelps you notice: card fraud online, scam calls
  3. If threatened: do not pay, keep the messages, report it to the policeabout 30 minfreeLimits harm from: extortion
  4. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  5. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  6. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next17 events

  1. Undetected 2 events9 days · show events
  2. Response 8 eventsNo individual notice on record · show events
  3. RemedyNone on record
  4. Penalty 5 eventsFine £14M · show events
  5. Disputes 2 eventsJudgment · show events
  1. Court refused Capita's application to strike out the group claim as an abuse of process
  2. ICO penalty notice: the evidence does not show significant actual harm, but the ICO found significant potential for harm
  3. ICO found a 58-hour delay in quarantining the first infected device despite a high-priority alert within 10 minutes
  4. Fined £14m in total (£8m Capita plc, £6m Capita Pension Solutions) after a voluntary settlement; Capita admitted liability and agreed not to appeal
  5. Notice of intent: proposed penalties of £25m (Capita plc) and £20m · Capita Pension Solutions
12 more
  1. Multi-party damages claim issued in the High Court; 3,973 claimants by the 2026 judgment
  2. The Pensions Regulator published an intervention report; it had contacted 383 Capita-administered schemes
  3. Half-year results put exceptional costs of the incident at £20m to £25m
  4. Regulatory announcement: data exfiltrated from under 0.1% of servers; exceptional costs of about £15m to £20m expected
  5. About 90 client organisations had reported breaches to the ICO, which said it was making enquiries
  6. Capita disclosed evidence of limited data exfiltration that might include customer, supplier or staff data
  7. Black Basta posted samples of Capita data on its leak site
  8. Capita announced a cyber incident affecting internal Microsoft Office 365 access
  9. Breach reported to the ICO about 14 hours after ransomware was deployed
  10. Capita interrupted the intrusion that began around 22 March
  11. Capita became aware of the intrusion; data had already been exfiltrated
  12. Intrusion began
Company
Capita
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
6,656,037 people whose data was exfiltrated, across Capita and the pension schemes and other clients it served · ICO penalty notice

How the facts developed

  1. ICO penalty notice: 6,656,037 people's data exfiltrated, item list published; £14m fine
  2. Capita confirmed data was exfiltrated from under 0.1% of its servers and began notifying clients

Sources