Capita fined £14M after 58-hour delay exposed 6.6M records
- Reference: 1760526102
- News link: https://www.theregister.co.uk/2025/10/15/ico_fines_capita_14m/
- Source link:
The fine breaks down as £8 million ($10.6 million) for Capita plc and £6 million ($8 million) for Capita Pension Solutions. The breach affected 325 of the 600-plus organizations that rely on Capita's services, compromising sensitive employee and pension records.
The ICO's [1]full report into Capita's failings [PDF] revealed the attackers accessed highly sensitive information, including full bank and credit card details, biometrics data, passport information, login details, child data, and more. The data exposed varied for each of the 6.6 million individuals caught up in the breach.
[2]
John Edwards, UK Information Commissioner, said: "Capita failed in its duty to protect the data entrusted to it by millions of people. The scale of this breach and its impact could have been prevented had sufficient security measures been in place.
[3]
[4]
"When a company of Capita's size falls short, the consequences can be significant. Not only for those whose data is compromised – many of whom have told us of the anxiety and stress they have suffered – but for wider trust amongst the public and for our future prosperity. As our fine shows, no organization is too big to ignore its responsibilities.
The ICO initially planned to fine the outsourcer £45 million ($60.1 million), but but reduced it after Capita demonstrated security improvements, provided victim support, and cooperated with authorities including the National Cyber Security Centre.
[5]
Capita recorded £116.6 million ($155.5 million) in profit after tax for calendar 2024, meaning the fine equates to around 12 percent of this figure.
According to [6]Tussell data, since the [7]mega breach , the UK government has awarded Capita 241 contracts worth a combined £6 billion ($8 billion), although there is little mention of cybersecurity responsibilities in any of them.
Dissecting the attack
At the heart of the failures was Capita's slow response to the initial intrusion in March 2023, with crucial containment measures not enacted for 58 hours after its systems detected a potential compromise.
It all started with a malicious JavaScript download. How this was triggered remains unknown, but is believed to be a drive-by-download, since Microsoft's report into the attack did not find evidence of phishing.
The attacker then installed Qakbot malware and the widely abused Cobalt Strike pentesting tool.
[8]
Capita's security operations center (SOC) failed to respond to a high-level P2 alert, and a missed SLA alert, which were created after the JavaScript download.
The attacker then logged into a staff device using a backup admin account, 4 hours and 21 minutes after the initial compromise at 07:52 on March 22, 2023.
The ICO's analysis states there were traces of Kerberos credential harvesting at play and it is likely Capita's Active Directory was compromised. The attacker may have cracked a hashed password to gain access and log into the backup admin account.
In a series of critical failures, CAPITA\backupadmin service account violated Microsoft's security best practices: It had domain admin privileges instead of least-privilege access; lacked device access restrictions; wasn't monitored for compromise; had no tiered access model; and it lacked privileged access management (PAM) controls.
The attacker leveraged this account to pivot into eight other Capita domains. Notably, three previous penetration tests dating back to August 2022 had identified this exact vulnerability, but Capita took no corrective action.
More than 24 hours after the initial compromise, Capita's Trellix [9]EDR system detected Qakbot recovering and decrypting usernames and passwords from the staff device. The SOC didn't quarantine the infected device until March 24 — 58 hours after the JavaScript download.
Despite Capita's stated 45-minute response time for P2 alerts (with a 1-hour SLA), the company took 57 hours. The ICO noted that [10]Qakbot and [11]Cobalt Strike should have triggered an immediate P1 alert that demanded immediate remediation, not P2.
By the time Capita responded, as the attacker had already established a persistent foothold in the network and gained access to a domain admin account, allowing them to move laterally around the network.
[12]Southern Water uses Capita's AI tool to flush customer complaints
[13]Capita's Northern Ireland school IT deal swells to over half a billion after Fujitsu exit
[14]UK energy watchdog slaps down Capita's £130M smart meter splurge
[15]Capita wins £135M extension on much-delayed UK smart meter rollout
For four days – March 24-28 – they conducted network reconnaissance using Cobalt Strike and Bloodhound before Capita detected three compromised staff devices and contained them.
The ICO noted that Capita had just one SOC analyst on duty across the entire company at the time of the incident. This was despite consistently missing its P2 alert SLA targets (mostly below 30 percent since November 2022 against a target of 95 percent), and the number of its P2 alerts rising 100 percent in the six months prior to the attack.
The attacker began extracting data using SystemBC and Rclone, stealing approximately 1 TB of information within 24 hours.
In its analysis of the attack, the ICO said: "Capita has still not shown that the systems from which personal data was exfiltrated had ever had a penetration test at any point. Furthermore, there is no evidence that Capita had ever undertaken an internal audit of the security of these business units from which personal data was exfiltrated."
In the early hours of March 31, the attacker deployed ransomware on at least 1,057 hosts and triggered a global password reset of 59,359 accounts, after which time the outsourcer reported the ordeal to the ICO.
Capita had mostly recovered by April 6, but its full system restoration was staggered until May 17, when 99 percent of systems were available. It reached 100 percent uptime by "mid-June 2023."
Capita's response
The ICO's full incident report shows how Capita attempted to argue on multiple occasions that ICO officials did not have the regulatory remit to comment on its security posture. In most of these cases, the ICO disagreed.
In a statement responding to today's fine, Capita said it regrets the incident and is committed to improving its systems.
Adolfo Hernandez, CEO at Capita, [16]said : "As an organisation delivering essential public services as well as key services for private sector clients, Capita was among the first in the recent wave of highly significant cyber-attacks on large UK companies."
"When I joined as CEO the year after the attack I accelerated our cybersecurity transformation, with new digital and technology leadership and significant investment. As a result, we have hugely strengthened our cybersecurity posture, built in advanced protections and embedded a culture of continuous vigilance."
"Following an extended period of dialogue with the ICO over the last two years, we are pleased to have concluded this matter and reach today's settlement. The Capita team continues to focus tirelessly on our Group transformation journey for the benefit of our customers, our people, and wider society."
Edwards at the ICO said: "With so many cyberattacks in the headlines, our message is clear: every organization, no matter how large, must take proactive steps to keep people's data secure. Cybercriminals don't wait, so businesses can't afford to wait either – taking action today could prevent the worst from happening tomorrow."
®
Get our [17]Tech Resources
[1] https://ico.org.uk/media2/pv5nhks4/capita-plc-and-cpsl-monetary-penalty-notice.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aO_FF4U0R8e6rdRD7ZpaGwAAAQI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aO_FF4U0R8e6rdRD7ZpaGwAAAQI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aO_FF4U0R8e6rdRD7ZpaGwAAAQI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aO_FF4U0R8e6rdRD7ZpaGwAAAQI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] http://www.tussell.com/
[7] https://www.theregister.com/2024/03/06/capita_says_2023_cyberattack_recovery/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aO_FF4U0R8e6rdRD7ZpaGwAAAQI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2025/08/14/edr_killers_ransomware/
[10] https://www.theregister.com/2025/05/22/qakbot_criminal_mastermind_charged/
[11] https://www.theregister.com/2024/07/04/europol_cobalt_strike_crackdown/
[12] https://www.theregister.com/2025/04/11/southern_water_uses_capitas_ai/
[13] https://www.theregister.com/2025/03/24/northern_ireland_capita/
[14] https://www.theregister.com/2024/11/15/ofgem_smart_meter_capita/
[15] https://www.theregister.com/2024/09/24/capita_wins_135_million_extension_smart_meters/
[16] https://www.capita.com/news/capita-reaches-settlement-ico-regarding-2023-cyber-attack
[17] https://whitepapers.theregister.com/
Indeed - it seems from the report that some contracts awarded to Crapita by its clients were on the basis of it being a "Data Processor" under the legislation - what we now need is additional follow up investigations from the ICO to those organisations that contracted with Crapita, who would legally be the "Data Controller", and therefore primarily responsible for the data of their users
If those organisations are not also penalised for basing their decisions on "cheapest wins", then ultimately nothing will change
Isn't it more like usual suspect wins, than cheapest?
Exactly. I doubt the usual suspects are ever the cheapest, just that the requirements are carefully written to exclude the cheaper options.
Exactly, as their pension services wing was impacted, a lot of people would have been affected through no fault of their own.
Is that a joke ?
" ICO makes example of outsourcing giant "
Capita. 2024 revenue : [1]£2.4 billion .
Fine ? 0.58% of annual revenu.
You call that an example ? I call that pocket change. The CEO probably has that lying in his sofa cushions.
You want to make an example ? 10% of 2.4 billion is 240 million.
Fine them that and watch them scramble for it to never happen again.
Make 'em sweat, instead of going to a restaurant to celebrate after your piddling little "fine".
[1] https://www.capita.com/news/full-year-results-2024
Re: Is that a joke ?
Indeed. The figure was reduced for behaving well _after_ the incident. The figure should only be reduced for behaving well _before_ the incident.
Re: Is that a joke ?
Behaving well trying to argue the toss with the ico
Hate to see bad behaviour
Re: Is that a joke ?
> You want to make an example ? 10% of 2.4 billion is 240 million.
Fine them 10 times the total remuneration, during the year of the breach and the previous and subsequent years, of the members of the board of directors, including all bonuses and resignation pay-offs.
Re: Is that a joke ?
I would guess that any fine will be added to the government's bill for their future outsourcing to Capita, under additional, essential expenditure (supply chains, invasion of Ukraine, Covid, taxiffs, Cost of Living Crisis etc). If they had increased the fine, they would end up paying more. The Royal Mail got fined £21m today, so I guess postage rates will be going up again soon. That's how it works.
Quote: Microsoft's security best practices.
That bit made me laugh.
Re: Is that a joke ?
A joke that the public has been falling for for over fifty years no less.
Incompetent Commissioner Office
Napkin maths says it is about £2.12 per record.
At £2.12 per record, Capita’s penalty roughly aligns with black-market retail value of low-to-medium-value personal data, but far below what regulators could impose under GDPR (up to 4 % of global turnover).
In other words ICO is having a laugh.
Re: Incompetent Commissioner Office
Another toothless quango
Capita....
The grift that keeps on grifting....
Re: Capita....
There is one R in Crapita.
A company that needs breaking up
Crapita have sucked up lots of companies so that they can claim to provide a whole range of services. Indeed they do provide a wide range of services, most of which they do badly. I have experience of their recent services provided to UK military recruitment.
Nah, you don't seed soldiers / sailors and airmen to man a recruiting office, Capita can do it for you.
"In 2017-18, Capita recruited 6,948 fewer regular and reserve soldiers and officers than the Army's target. The shortfall has been largest for regular soldiers." [Hansard]
Crapita have also screwed teachers' pensions. My friend's wife has had to retire due to ill health and is still (4 months on) waiting for a proper pension valuation.
About 7-8 years ago they bought out a smallish but very good network provider, and promptly sacked or "redeployed" all of the best engineers in the name of cost saving. My old business centre used the small company as they were local but have now binned Crapita off due to the poor service and high costs.
There must be some really big brown envelopes being handed out for this shower to continue getting government contracts.
John Edwards, UK Information Commissioner, said: "Capita failed in its duty to protect the data entrusted to it by millions of people. The scale of this breach and its impact could have been prevented had sufficient security measures been in place.
I'm willing to bet that the vast majority of these people didn't willingly entrust their data to Crapita at all, and that this was done so either without their explicit knowledge, or in the small print that nobody reads of their agreement with whoever it was they actually "entrusted" their data to. I also strongly suspect there was no real choice given to people about whether they explicitly gave that trust or not, if these are things like pension schemes, where your option is "pay in, or don't".