News

FAQs about the Capita data breach

In March 2023, criminals exfiltrated data from Capita’s servers during a ransomware attack. After the privacy failure, our lawyers started an investigation into the Capita data breach. We also launched a no-win, no-fee compensation claim.

Here are some of the questions we have been asked about our Capita data breach group action.

How did the Capita data breach happen?

In March 2023, criminals exfiltrated data from Capita’s servers, exposing the private data of potentially half a million pension holders and their beneficiaries. Capita was attacked by the criminal ransomware gang, Black Basta. To access Capita’s systems, the criminals likely found and exploited a vulnerability in Capita’s cyber security.

What data was stolen in the Capita data breach?

The list of potentially compromised data includes:

According to reports, the data might include other valuable information – possibly including sensitive and special category data. We understand financial/bank details were also included.

This personal and financial information may have been stolen for sale on the dark web.

What has Capita said about the breach?

In April 2023, Capita said:

It had experienced a cyber incident which primarily impacted access to internal Microsoft Office 365 applications
It had worked closely and at speed with specialist advisers and forensic experts in investigating the incident
There was evidence of data exfiltration which might include customer, supplier or colleague data.

How many people are affected by the Capita data breach?

Capita provides outsourced pension administration services to over 450 pension providers across the UK and many of them have confirmed that they were affected by this breach. As a result, over half a million UK pension holders could be at risk following the data security incident. As well as exposing the personal information of pension holders – the Capita data breach also affects their beneficiaries.

Was my information accessed in the breach?

Capita or the affected pension plan should be in touch to notify affected individuals. If you have not been told that your data was breached, it is unlikely that you are affected. If you were informed that your data was involved in the Capita data breach, you could have a no-win, no-fee compensation claim. Register to receive updates on our investigation and we’ll let you know more.

Am I at risk if my data was stolen in the Capita data breach?

To ensure they do not fall victim to further attacks, anyone affected by the Capita data breach should be vigilant.

A data breach can result in both financial and identity theft. With enough stolen information, cybercriminals can apply for credit in your name, set up fraudulent bank accounts, use your cards to make payments, and access your existing accounts. Criminals also use financial data in scams designed to extract additional information from victims (e.g. banking passwords). And hackers often sell stolen financial data to other criminals for future scams.

Even if no money is lost, the impact of a data breach can be significant. Many victims suffer from stress, anxiety and distress due to living with the added risk and the extra vigilance needed. According to Action Fraud, “if the exposed data relates to the likes of names, email addresses, phone numbers and dates of birth, it can cause damage of a different kind, namely psychological. Knowing that criminals know these details about you can cause distress, worry and anxiety.”

What is a group action?

A group action claim is where a group of people – sometimes even thousands of people – have been affected by the same issue. Group action cases are also known as class actions, multi-claimant, or multi-party actions.

How much will it cost me to claim?

There are no costs to join our Capita data breach claim. However, if your claim is successful, you may have to pay a ‘success fee’. This fee is taken from the compensation awarded to you. At KP Law, our success fee is competitive, and we make sure you are fully informed about any potential costs before you officially join our action. If you lose, you won’t have to pay a penny.