Which pension firms are involved in the Capita data breach?
Find out which UK pension schemes were affected by the Capita data breach. See if yours is on the list and how to start a group action for compensation.
The Capita data breach could affect six million people in the UK
Capita – one of the UK’s most prominent business process outsourcing and professional services companies – experienced a significant data protection breach in 2023. The Capita data breach could affect millions of UK pension holders.
A ransomware cyber-attack occurred in March 2023 when criminals accessed and then exfiltrated data from Capita’s servers. According to the Information Commissioner’s Office, around 90 organisations have reported data protection violations related to this incident.
Capita provides outsourced pension administration services to over 450 pension providers across the UK. Several of them have confirmed that they are affected by this breach. Personal data, including names, dates of birth and National Insurance numbers may have been accessed by hackers.
Other valuable information may also have been compromised and we understand financial/bank details were also affected.
“Data breach claims play an important role in holding organisations accountable when personal information is not adequately protected. Our team combines data protection expertise with experience of complex group actions to investigate breaches and pursue appropriate remedies.”
Kingsley Hayes | Partner & Head of Data & Privacy Litigation
22nd – 31st March 2023: Cyber Criminals accessed Capita’s systems
Capita discovered a “technical issue” which it later escalated to a “cyber incident primarily impacting access to internal applications”. At this time, Capita told journalists that it was “too early to say if it was a cyber security attack”. However, reports suggest1 that Capita was aware that it had been infected with ransomware by this date
Capita announced that it had experienced a cyber incident.
Capita posted a statement about the data breach on its website.
The Pensions Regulator (TPR) wrote to pension schemes that used Capita to warn them about the cyber incident and urged them to investigate whether they had suffered data breaches following the cyber attack.
The Universities Superannuation Scheme (USS) issued a statement on the Capita ‘cyber incident’.
Capita warned that the pension schemes of Marks and Spencer, Diageo, Unilever, and Rothesay might have been compromised in the attack.
It is reported that personal data belonging to dozens of Adur and Worthing residents was leaked by Capita.
The ICO released a statement on the Capita data breaches.
Following a detailed investigation, Capita notified the Trustee that, personal details of approximately 8,000 pensioner members with SIPS benefits were included in copies of the data that were taken by the cyber attackers.
The media reports that Capita has told some of its employees that their personal data, was stolen in the cyberattack.
We revealed that beneficiary data had also been exposed in the Capita Data Breach.
At KP Law, we represent clients in group actions with the innovation, resources and expertise needed to take on complex cases. Our GDPR, data breach and cybercrime specialists have more than 50 years of combined experience, making us one of the most experienced multi-claimant law firms in the UK. Working alongside leading barristers and legal experts, we provide the highest standard of support while leveraging the resources and global expertise required to pursue challenging claims successfully. With offices in London, Liverpool, Manchester and Birmingham, supported by technology that enables us to serve clients across England and Wales, we combine national reach with a modern, client-focused approach. By using innovative technology, operating on a no-win, no-fee basis, and keeping the process straightforward and hassle-free, we make accessing expert legal representation as simple as possible.
In March 2023, Capita experienced a cyber-attack. The incident left staff unable to access services and local authority and business services were disrupted. While Capita initially insisted that hackers had simply managed to disrupt the businesses’ internal systems, it is now accepted that the incident was a ransomware attack leading to a potential data breach.
Our investigators believe that the Russian-based ransomware group Black Basta was likely responsible. The criminals claimed they had the Capita data in a now-deleted online post. Capita has declined to comment on whether it paid the ransom.
The list of potentially compromised data includes:
According to reports 1, the data might include other valuable information – possibly including sensitive and special category data.
We understand financial/bank details were also included.
The compromised employee data includes dates of birth, marital status, home addresses, salary, email addresses, employment details and employment history.
Some GP data, including patient data, has also been affected.
On March 31 2023, Capita said:
“Following a technical problem which has affected access to some of our services today, we can confirm that we have identified an IT issue that is primarily impacting our internal systems. We are working to swiftly restore those services that have been affected and will issue a further update in due course.”
On 20 April 2023, Capita provided more information when it posted the following statement on its website:
“On 3 April 2023, Capita plc (“Capita”) announced that it had experienced a cyber incident which primarily impacted access to internal Microsoft Office 365 applications.
“Since the incident, Capita and its technical partners have restored Capita colleagues’ access to Microsoft Office 365. The majority of Capita’s client services were not impacted by the incident and remained in operation, and Capita has now restored virtually all client services that were impacted.
“In parallel with the services restoration activity, Capita has continued to work closely and at speed with specialist advisers and forensic experts in investigating the incident to provide assurance around any potential customer, supplier or colleague data exfiltration.
“From our investigations to date, it appears that the incident arose following initial unauthorised access on or around 22 March and was interrupted by Capita on 31 March. As a result of the interruption, the incident was significantly restricted, potentially affecting around 4% of Capita’s server estate. There is currently some evidence of limited data exfiltration from the small proportion of affected server estate which might include customer, supplier or colleague data.
“Capita continues to work through its forensic investigations and will inform any customers, suppliers or colleagues that are impacted in a timely manner.
“Capita continues to comply with all relevant regulatory obligations.”
Capita or the affected pension plan should be in touch to notify affected individuals.
Anyone who thinks they might be involved should take immediate steps to protect themselves. Find out how to do this here.
If you receive notification that you are affected by the Capita pension data breach, register to receive updates on our investigation. We’ll let you know what’s happening, and if and when you can make a no-win, no-fee data breach compensation claim.
A group action claim is where a group of people – sometimes even thousands of people – have been affected by the same issue. Group action cases are also known as class actions, multi-claimant, or multi-party actions.
If we do launch a group action, there are no costs to join a claim. However, if your claim is successful, you may have to pay a ‘success fee’. This fee is taken from the compensation awarded to you. At KP Law, our success fee is competitive, and we make sure you are fully informed about any potential costs before you officially join our action. If you lose, you won’t have to pay a penny.
Find out which UK pension schemes were affected by the Capita data breach. See if yours is on the list and how to start a group action for compensation.
Get answers to your questions about the Capita data breach. Learn what happened, who’s affected, and how to claim compensation for your compromised data.
Nelsons faced a cyber incident exposing sensitive data. Learn whether you were impacted by the breach and how to join the group action for compensation.
“Used KP Law for a group data breach compensation claim. I was kept updated throughout the process. The whole thing was easy with no stress.” – Anon
“I used the firm as part of a group action following a, potentially, hazardous data breach. From the very start, I was kept updated regarding the other side’s actions and what the counter actions were. I found KP to be trustworthy, knowledgeable and very customer friendly.” – Pat
“I used KP Law for the first time for a data breach group compensation claim. From outset to conclusion I was kept fully informed and received clear, regular updates throughout. I would not hesitate to recommend them and would choose them in any future action.” – Owen
By not putting adequate processes and training in place, organisations are leaving customers open to an increased risk of cyber scams and avoidable mistakes that lead to data breaches. If you are a victim of a data protection failure, check out our current group actions below to see if we are running a claim related to that specific breach.
Unsure if your personal data has been exposed in a breach? Learn how to check and what steps to take, including your right to join a group claim in the UK.
At KP Law, our expert data breach lawyers want to lessen the impact of a data violation as much as possible. To help, we have collated a range of support, information and other resources to help you get your life back on track.
