- Company
- Capita
- Regulator or court
- Information Commissioner's Office (ICO)
- Law
- UK GDPR, Articles 5(1)(f) and 32 (security)
- Status
- Final (settled, no appeal)
What happened
In 2023 attackers got into Capita's systems and took personal data of about 6.6 million people, including pension, staff and in some cases financial and criminal-record information. The ICO found known weaknesses had been flagged several times without being fixed, and that a high-priority security alert went unanswered properly for 58 hours. Capita admitted liability and agreed to pay without appealing.
Sources
ICO press releaseICO penalty notice (PDF)Summary in our own words. General information, not legal advice.