ENKR

Capita cyber attack and data theft

Add to my breach check

Made public

What leaked19

Replaceable

  • Card CVV/CVC
  • Card number

Hard to replace

  • ID card image
  • Driver's licence number
  • Income, balances, loans, credit or other financial details
  • Passport number
  • Bank account number
  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data
  • Username

Permanent

  • Biometric data
  • Health information
  • National ID or tax number
  • Sexual orientation or preferences
  • Ethnicity, religion or political views
  • Date of birth
  • Full name
  • Biometric datafor some people · ICO
  • Card CVV/CVCdebit card CVV for some people · ICO
  • Card numbercredit or debit card number for some people · ICO
  • Health informationhealth information and medical numbers for some people · ICO
  • ID card imagepassport, driving licence and photo ID scans for some people · ICO
  • National ID or tax numberNational Insurance number
  • Sexual orientation or preferencessexual orientation, for some people · ICO
  • Ethnicity, religion or political viewsfor some people: ethnic origin, political and religious beliefs, trade union membership · ICO
  • Driver's licence numbertaken for some people only · ICO
  • Income, balances, loans, credit or other financial detailspension details for some people · ICO
  • Passport numbertaken for some people only; not every type was taken for each person · ICO
  • Bank account numberaccount number and sort code, or IBAN
  • Mobile numberphone number
  • Other profile datafor some people: criminal record checks, signatures · ICO
  • Usernameemployee login details

To-dos6 · about 1 h 30 min in all

  1. Have the card reissued with a new numberabout 15 minStops: card fraud online
  2. Turn on instant transaction alertsabout 5 minHelps you notice: card fraud online, scam calls
  3. If threatened: do not pay, keep the messages, report it to the policeabout 30 minfreeLimits harm from: extortion
  4. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  5. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  6. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next17 events

  1. Undetected 2 events9 days · show events
  2. Response 8 eventsNo individual notice on record · show events
  3. RemedyNone on record
  4. Penalty 5 eventsFine £14M · Back to latest
  5. Disputes 2 eventsJudgment · show events

Penalty: 5 events

Back to latest
  1. ICO found a 58-hour delay in quarantining the first infected device despite a high-priority alert within 10 minutes
  2. Fined £14m in total (£8m Capita plc, £6m Capita Pension Solutions) after a voluntary settlement; Capita admitted liability and agreed not to appeal
  3. Notice of intent: proposed penalties of £25m (Capita plc) and £20m · Capita Pension Solutions
  4. The Pensions Regulator published an intervention report; it had contacted 383 Capita-administered schemes
  5. About 90 client organisations had reported breaches to the ICO, which said it was making enquiries
Company
Capita
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
6,656,037 people whose data was exfiltrated, across Capita and the pension schemes and other clients it served · ICO penalty notice

How the facts developed

  1. ICO penalty notice: 6,656,037 people's data exfiltrated, item list published; £14m fine
  2. Capita confirmed data was exfiltrated from under 0.1% of its servers and began notifying clients

Sources