The Information Commissioner’s Office has issued a fine of £14 million to Capita for failing to ensure the security of personal data related to a breach in 2023 that saw hackers steal millions of people’s information.

Capita plc has been fined £8m and Capita Pension Solutions Limited has been fined £6m, giving a combined total of £14m.

The cyber attack took place in March 2023. The personal information of 6.6m people was stolen, from pension records and staff records to the details of customers of organisations Capita supports. This included sensitive information such as details of criminal records, financial data or ‘special category’ data.

The ICO initially informed Capita of its provisional intention to fine it a combined total of £45m. Capita then submitted representations and mitigating factors on the provisional decision, which the ICO considered. This included the improvements made after the attack, support offered to affected individuals and engagement with other regulators and the National Cyber Security Centre.

The ICO and Capita have now agreed to a voluntary settlement. Capita has acknowledged the ICO’s decision and admitted liability, agreeing to pay a final penalty of £14m without appealing.