Capita fined £14m for cyber-attack which affected millions

Capita fined £14m for cyber-attack which affected millions

In the aftermath of a cyber-attack that resulted in the theft of personal data belonging to 6.6 million individuals, outsourcing firm Capita has been fined £14m by the UK’s data watchdog. The Information Commissioner’s Office (ICO) highlighted that Capita’s failure to ensure the security of personal data processing put it at significant risk, leading to the substantial fine. Originally, the fine was set at £45m, but negotiations between Capita and the ICO resulted in a reduced penalty.

Adolfo Hernandez, the CEO of Capita, expressed relief at resolving the issue and reaching a settlement. He emphasized the company’s efforts in significantly strengthening its cyber-security resilience and remaining vigilant in light of the cyber-attack. Capita, a provider of professional and outsourcing services across various sectors, recorded £2.4bn in revenue in the previous year as highlighted in its annual report.

Following the breach in March 2023, it was revealed that Capita had exposed a pool of data online, including sensitive information such as home addresses and passport images. This data reportedly began circulating on the dark web, underscoring the severity of the breach. The ICO revealed that financial information and criminal records were among the data stolen, with over 600 pension schemes, including 325, being impacted by the incident. Information Commissioner John Edwards condemned Capita for failing to safeguard the data entrusted to them, emphasizing that the breach’s magnitude could have been mitigated with adequate security measures in place.

The initially proposed fine of £45m was reduced to £14m after Capita demonstrated improvements in its cyber-security measures, offered support to affected individuals, and collaborated with other regulatory bodies and the National Cyber Security Centre (NCSC). This accountability for data protection shortcomings was commended by Trevor Dearing from Illumio, a cyber-security firm, who stressed that holding companies liable for breaches sends a significant message to both regulators and data breach victims. The incident involving Capita adds to a string of high-profile cyber-attacks on companies like Co-op, M&S, Harrods, and Jaguar Land Rover, highlighting the escalating threat of cyber security breaches in today’s digital landscape

Read the full article from The BBC here: Read More