ENKR

Capita cyber attack and data theft

Add to my breach check

Made public

What leaked19

Replaceable

  • Card CVV/CVC
  • Card number

Hard to replace

  • ID card image
  • Driver's licence number
  • Income, balances, loans, credit or other financial details
  • Passport number
  • Bank account number
  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data
  • Username

Permanent

  • Biometric data
  • Health information
  • National ID or tax number
  • Sexual orientation or preferences
  • Ethnicity, religion or political views
  • Date of birth
  • Full name
  • Biometric datafor some people · ICO
  • Card CVV/CVCdebit card CVV for some people · ICO
  • Card numbercredit or debit card number for some people · ICO
  • Health informationhealth information and medical numbers for some people · ICO
  • ID card imagepassport, driving licence and photo ID scans for some people · ICO
  • National ID or tax numberNational Insurance number
  • Sexual orientation or preferencessexual orientation, for some people · ICO
  • Ethnicity, religion or political viewsfor some people: ethnic origin, political and religious beliefs, trade union membership · ICO
  • Driver's licence numbertaken for some people only · ICO
  • Income, balances, loans, credit or other financial detailspension details for some people · ICO
  • Passport numbertaken for some people only; not every type was taken for each person · ICO
  • Bank account numberaccount number and sort code, or IBAN
  • Mobile numberphone number
  • Other profile datafor some people: criminal record checks, signatures · ICO
  • Usernameemployee login details

To-dos6 · about 1 h 30 min in all

  1. Have the card reissued with a new numberabout 15 minStops: card fraud online
  2. Turn on instant transaction alertsabout 5 minHelps you notice: card fraud online, scam calls
  3. If threatened: do not pay, keep the messages, report it to the policeabout 30 minfreeLimits harm from: extortion
  4. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  5. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  6. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next17 events

  1. Undetected 2 events9 days · show events
  2. Response 8 eventsNo individual notice on record · Back to latest
  3. RemedyNone on record
  4. Penalty 5 eventsFine £14M · show events
  5. Disputes 2 eventsJudgment · show events

Response: 8 events

Back to latest
  1. ICO penalty notice: the evidence does not show significant actual harm, but the ICO found significant potential for harm
  2. Half-year results put exceptional costs of the incident at £20m to £25m
  3. Regulatory announcement: data exfiltrated from under 0.1% of servers; exceptional costs of about £15m to £20m expected
  4. Capita disclosed evidence of limited data exfiltration that might include customer, supplier or staff data
  5. Black Basta posted samples of Capita data on its leak site
3 more
  1. Capita announced a cyber incident affecting internal Microsoft Office 365 access
  2. Breach reported to the ICO about 14 hours after ransomware was deployed
  3. Capita interrupted the intrusion that began around 22 March
Company
Capita
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
6,656,037 people whose data was exfiltrated, across Capita and the pension schemes and other clients it served · ICO penalty notice

How the facts developed

  1. ICO penalty notice: 6,656,037 people's data exfiltrated, item list published; £14m fine
  2. Capita confirmed data was exfiltrated from under 0.1% of its servers and began notifying clients

Sources