Capita capita.com Capita data breach: what happened and what to do
Attackers got into Capita's systems from 22 March 2023 and stole personal information of 6.6 million people, including pension and staff records. In October 2025 the ICO fined Capita £14 million.
View all 13,177 breaches- Breach date
- 22 Mar 2023
- Affected
- 6,600,000
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
The ICO's statement says the attack began on 22 March 2023, when a malicious file was downloaded onto a Capita employee's device. A high priority alert fired within 10 minutes, but the ICO found the device was not quarantined for 58 hours. In that time the attacker took personal information of 6.6 million people.
Sources checked: ico.org.uk, theregister.com, actionfraud.police.uk
Last verified against the official page:
Who was affected
The stolen records included pension records, staff records and details of customers of organisations Capita supports. Capita Pension Solutions Limited handles personal data for over 600 pension scheme organisations, and 325 of them were affected. The ICO says some people's records held sensitive details such as criminal records, financial data or special category data.
If you belong to a pension scheme that Capita administers, your scheme should have written to you. The Register covers the fine and the timeline.
The fine
On 15 October 2025 the ICO fined Capita plc £8 million and Capita Pension Solutions Limited £6 million, £14 million in total. It had first proposed £45 million and lowered the figure after weighing Capita's security improvements and the support it offered affected people. Capita accepted the penalty without appealing.
What this lets criminals do
Pension and employment records usually carry names, addresses, dates of birth and National Insurance numbers. That is enough for fraudsters to impersonate you, to target you with pension scams that quote real details, or to try to take out credit in your name.
What to do if you were in it
- 1
Read the letter from your pension scheme or employer
It says what was taken for you and what support is offered. Treat a message that only claims to be from Capita or your scheme as suspect until you've checked it through the scheme's own website or number.
- 2
Watch for pension and credit scams
Don't act on cold calls, texts or emails about your pension, and don't move pension money after unsolicited contact. Report scams to Action Fraud.
- 3
Check your credit file
Look at your credit reports for accounts you didn't open. If identity details leaked, ask a credit reference agency about a Cifas protective registration through Cifas.
- 4
Be suspicious of messages that mention the breach
Don't click links in them. Go to the organisation's site yourself.
- 5
Check which other breaches include you
A free Serus scan checks breach databases for your email, phone and other details.
Frequently asked
Was I affected by the Capita data breach?
The ICO says 6.6 million people were affected, through 325 pension schemes and other Capita clients. Your scheme or employer should have notified you.
What was exposed?
Pension records, staff records and customer details of Capita's clients. The ICO says some people's records included criminal records, financial data or special category data.
Is there compensation?
The ICO fine is paid to the government, not to affected people. Law firms have announced group claims for compensation, so check the claim's terms before signing up.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
