Capita has been fined £14 million ($18.7 million) for failing to safeguard personal data during a 2023 cyberattack, the British outsourcing firm confirmed on Wednesday, following a settlement with the UK’s privacy regulator.
The company, which delivers business support services to both government and corporate clients, revealed last year that the breach had exposed some data stored on its servers, with an estimated financial impact of up to £20 million. Reports FinancialNews
According to a report published by the Information Commissioner’s Office (ICO) on Wednesday, the incident compromised the personal information of 6.7 million individuals.
Capita stated that it has since enhanced its cybersecurity framework, implementing advanced protections to prevent future breaches.
The settlement highlights growing regulatory pressure on UK firms facing cyber incidents, amid increasing scrutiny following major data breaches at Marks & Spencer and luxury carmaker Jaguar Land Rover.
“With so many cyber attacks in the headlines, our message is clear: every organisation, no matter how large, must take proactive steps to keep people’s data secure,” said John Edwards, UK Information Commissioner.
The Information Commissioner’s Office (ICO) stated that Capita failed to implement adequate safeguards to prevent privilege escalation and unauthorised lateral movement within its network, and did not respond effectively to security alerts.
