The Information Commissioner's Office (ICO) has fined Capita plc £8m, and Capita Pension Solutions Limited £6m, for ‘failing to ensure the security of personal data’ after hackers stole millions of people’s information in March 2023.

The ICO said the hack began after a malicious file was unintentionally downloaded onto an employee device and that despite a high priority security alert being raised, Capita did not quarantine the infected device for 58 hours.

An investigation found that cyber security failings were previously flagged as a vulnerability on at least three separate occasions but were not remedied, and that Capita’s security operations centre was understaffed.

Hackers were able to steal personal information from pension and staff records, along with details of the customers of organisations Capita supports. This included sensitive information such as details of criminal records, financial data, or special category data.