Capita data breach claim

The Capita Group is an outsourcing business that assists a large number of organisations to run their operations. Companies within the Capita Group process personal data on behalf of a range of businesses in both the public and private sector. Capita plc is the ultimate parent company of a large corporate group consisting of multiple legal entities, including Capita Pension Solutions Limited which processes personal information on behalf of over 600 organisations providing pension schemes. 

In late March 2023, the personal information of 6.6 million people was stolen by hackers, believed to be part of Russian-based ransomware group Black Basta, from the Capita Group, including the pension records, staff records and customer records of organisations supported by Capita. In particular, the data breach affected 325 of the over 600 organisations providing pension schemes whose personal data was processed by Capita Pension Solutions Limited. Personal data held by Capita Pension Solutions Limited and impacted in the breach, accounted for over 5.7 million of the 6.6 million people whose personal data was impacted by the breach.  

The attack began when a malicious file was unintentionally downloaded by a Capita employee on to their device on 22 March 2023. Despite discovering the attack within 10 minutes of the breach, Capita did not quarantine the device for 58 hours, during which time the hackers were able to exploit Capita’s IT systems. Between 29 and 30 March 2023, hackers took nearly one terabyte of data. On 31 March 2023, the hackers then installed ransomware and reset all user passwords so preventing Capita staff from accessing their systems. 

While it varied from individual to individual, the categories of personal data taken included the following: 

• Name; 

• Address; 

• International address; 

• Email address; 

• Phone number; 

• Date of birth; 

• Child data; 

• National Insurance (“NI”) number; 

• Driver’s licence / driver’s licence scan; 

• Passport number / passport scan; 

• Photo ID scan; 

• Other national ID / numbers; 

• Bank account numbers and sort codes; 

• Personal International Bank Account Number (“IBAN”); 

• Credit card number / credit card scan; 

• Debit card number and CVV / debit card scan; 

• Biometrics; 

• Employee login details; 

• Copies of signatures. 

In some cases this included ‘special category information’ including:  

• Health information; 

• Medical numbers; 

• Racial/ethnic origin; 

• Political beliefs; 

• Religious/philosophical beliefs; 

• Trade union membership; 

• Sexual orientation; 

• Criminal records (“CRB”) checks. 

Following a lengthy investigation into the March 2023 data breach suffered by Capita, the Information Commissioner’s Office (ICO) issued a Monetary Penalty Notice (MPN) of the incident on 15th October 2025. To view the MPN, please click here.

The ICO found that Capita failed to implement a range of appropriate technical and organisational measures to safeguard the personal data they held. As a result of these failures, the ICO found that Capita infringed the UK General Data Protection Regulation (GDPR) and fined Capita plc £8 million and Capita Pension Solutions Limited £6 million. 

The accompanying statement from the ICO specifically stated “Capita has acknowledged our decision and admitted liability, agreeing to pay a final penalty of £14 million without appealing.”  Read More

The organisations supported by Capita who it has been reported were affected by the data breach includes those found here.

However, it is likely that this list is incomplete and it is almost certain that there are other organisations, not on the list, who have been affected. 

If you have received a letter or email from either the organisation on whose behalf Capita was processing your information or Capita itself at some time after March 2023 saying that you were personally affected by the data breach suffered by Capita in March 2023, you may have a claim for compensation. 

This includes a claim for compensation for the distress caused by the data breach even if you have not lost any money. 

How much compensation you can claim may depend on a number of factors, including some specific to your situation, such as: 

• The sensitivity of the personal information accessed, including whether, for example, this included your bank account details or credit / debit card details. 

• How many people had unauthorised access to your personal information and for how long. 

• Emotional distress caused by the breach. 

• Any financial losses experienced. 

On the information currently available, we consider that the value of affected individuals’ compensation claims is likely to be over a thousand pounds after any deduction of our fees.

 ,

It will be necessary for us to obtain more information from you in due course as part of our investigation of your claim. 

We will obtain a more detailed assessment of the value of the claims from the barristers specialising in data breach matters that we are instructing in this matter after we have completed our investigations. 

It is too early to provide a timescale for when the matter will be resolved and, if successful, when you may receive any compensation for the data breach. To an extent, this will depend on how Capita respond and whether they wish to mediate or settle the claim. 

We understand this can be frustrating, but we will keep our clients updated every step of the way via email. You can also reach out to us by emailing capitadatabreach@leighday.co.uk 

We are responding to sign-up  form completions within 24 to 36 hours. If you have submitted your form during the weekend, please allow an extra day for responses, as we won’t see your details until the following Monday morning.

If you are still to receive a response after the above timescales, please email us at capitadatabreach@leighday.co.uk to check that the details we hold for you are correct. 

The data breach claim is still at an early stage, so no compensation has been given out at the time of writing. However, please be assured that we will keep our clients updated via email. 

You can also reach out if you need assistance at any point of the claims process by emailing capitadatabreach@leighday.co.uk. 

We are aware that Capita announced a second data breach in May 2023. The ICO said in a statement that a “second data breach emerged in May when it was reported that the firm had left benefits data fields in publicly accessible storage, prompting several councils to say they thought their data had been compromised.” 

It is reported that this second breach affected a number of local councils for whom Capita was processing personal data, including Adur and Worthing Councils, Colchester Council, Coventry City Council, Derby City Council, Rochford District Council and South Staffordshire Council. The personal data affected in this second breach included constituents’ benefit details, including PIP (Personal Independent Payment) information. 

At this time, we are not acting for those affected by this separate Capita data breach of May 2023. So, if you were affected by this different data breach, please do not sign up to this claim.