View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Technology
May 5, 2023

Pension fund data may have been accessed during Capita cyberattack

The fallout from March's attack continues, and it remains unclear what data has been stolen from the outsourcing giant.

By Claudia Glover

Outsourcing giant Capita has written to pension funds warning that their data may have been compromised during a cyberattack. The Financial Conduct Authority (FCA) has also contacted some of Capita’s clients urging them to investigate the security of their data as fall-out from the incident in March continues.

Capita continues to feel effects of a cyberattack earlier this year. (Photo by Postmodern Studio/Shutterstock)

Capita has written to its pension clients confirming their data is stored on servers that have been accessed by the cybercriminals who perpetrated what it describes as a “cyber incident”. No group has claimed responsibility for the breach, which left Capita staff unable to access Office 365 and other internal systems.

The company is among the UK government’s largest suppliers, holding public sector contracts worth £6.5bn across outsourced IT services and other areas. It has 50,000 employees and operates across Europe, India and South Africa, as well as the UK.

Clients across the UK, particularly those in the public sector, were hampered by the attack and left unable to access services provided by Capita for several days.

Capita cyberattack: warning over pension data

Having initially said no data was accessed in the cyberattack, Capita confirmed last month that it has found “some evidence of limited data exfiltration” on around 4% of its servers.

The message, seen by the FT and sent to Capita’s pension clients, explains that some of their data “is likely to have been exfiltrated.” Capita provides services to hundreds of UK pension funds.

It says: “To be clear, this does not necessarily mean that your data has been identified as exfiltrated, it means that your data was on [Capita] servers from which some data is likely to have been exfiltrated.” An investigation is ongoing.

Content from our partners
Scan and deliver
GenAI cybersecurity: "A super-human analyst, with a brain the size of a planet."
Cloud, AI, and cyber security – highlights from DTX Manchester

Capita said it is “working closely with specialist advisers and forensic experts to provide assurance around any potential customer, supplier or colleague data exfiltration”. The value of the company’s shares has fallen by 16% since the hack occurred. “Capita has already confirmed that it continues to comply with all relevant regulatory obligations, establishing and maintaining an ongoing dialogue with relevant regulatory bodies is therefore not at all unusual,” a Capita spokesperson added.

The Financial Conduct Authority wades in

Earlier this week the FCA has urged Capita clients, including public sector agencies, insurers and pension funds, to check if their member and consumer data has been compromised in the hack. 

The financial regulator said it has “written to regulated firms that are clients of Capita to ensure they are fully engaged in understanding the extent of any data compromise.”

“We have continued to engage with Capita since their cyber incident was reported to understand the extend of any data compromise and impact on the firms they provide outsource services to, including their underlying customers,” the FCA said. 

Read more: The UK’s new National Fraud Strategy doesn’t go far enough

Topics in this article :
Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.