Legal claim launched following recent critical report of major data breach at outsourcing giant Capita in 2023
Following a major data breach at outsourcing and technology giant Capita that exposed the personal information of millions of people, law firm Leigh Day has launched a legal claim for those affected to pursue compensation for financial loss and emotional distress.
Posted on 01 December 2025
The outsourcing giant was the victim of a serious cyber-attack in March 2023, when hackers stole the personal data of approximately 6.6 million people. The stolen information included highly sensitive details such as financial and medical records, as well as pension and staff data from organisations supported by Capita.
In October 2025, the Information Commissioner’s Office (ICO), the public body responsible for upholding information rights, fined Capita £14 million for failing to implement adequate technical and organisational measures to protect this data, in breach of the UK General Data Protection Regulation (GDPR).
The exact categories of personal data compromised varied from individual to individual but in many cases are believed to include:
- Names, addresses, email addresses and phone numbers
- Dates of birth and National Insurance numbers
- Bank account details and credit/debit card information
- Driving licence and passport numbers
- Photo ID scans and biometric data
- Employee information and signatures
In some cases, the breach also involved special category data, such as health information, racial or ethnic origin, political and religious beliefs, sexual orientation, and criminal record checks.
Leigh Day is one of the UK’s leading law firms in data protection and privacy litigation and has acted in numerous high-profile data breach cases – including representing Afghan citizens whose highly sensitive personal data was disclosed by the Ministry of Defence.
The human rights law firm has decades of experience running large group actions and individual claims for breaches of confidential information, often against major corporations and government departments.
Sean Humber, Leigh Day partner and data breach specialist, said:
“This was a serious failure to safeguard the personal information of millions of people. The ICO’s findings make clear that Capita did not have adequate security measures in place to protect this information.”
Gene Matthews, Leigh Day partner and group claims specialist, said:
“Those affected are likely to have strong claims for compensation for the distress caused by the breach, as well as any financial losses suffered. While the amounts are likely to vary from individual to individual, many of the claims for compensation are likely to be substantial.”
Sean Humber
Sean is an experienced human rights lawyer and privacy breach compensation claims specialist
Gene Matthews
Gene specialises in consumer law, product liability and data protection claims mainly brought as group claims/ multi-party actions
Capita Data Breach Claim
In March 2023, Capita was the victim of a serious cyber-attack in which the personal data of 6.6 million people was stolen, including, in some cases, people’s financial, medical and other very sensitive information. In October 2025, Capita was fined £14 million for failing to keep this personal data safe. Those affected are likely to have claims for compensation for any distress and / or financial losses suffered.