Capita to pay £14 million for data breach impacting 6.6 million people

Capita was breached in March 2023 when a malicious file allowed attackers (claiming to be Black Basta) into its Microsoft 365 environment; attackers remained for 58 hours, exfiltrated nearly 1 TB of data affecting 6.6 million people and hundreds of clients (including 325 pension providers), then deployed ransomware and reset user passwords. The UK Information Commissioner’s Office reduced an initial £45m proposed fine to £14m after Capita accepted liability and implemented security improvements.