Capita Data Breach: Who to Ask for Your Data

According to the ICO, a malicious file was downloaded onto an employee’s device on 22 March 2023. A high-priority security alert was raised within ten minutes, but the device was not quarantined for 58 hours. Between 29 and 30 March nearly one terabyte of data was taken, and on 31 March ransomware was deployed and Capita reported the incident to the ICO.

Capita’s own account of the incident says independent specialists monitored the dark web “and confirmed that no exfiltrated data was circulating or available for sale”. It publishes no helpline or contact route for affected people.

Pension schemes were told later. One scheme, USS, says Capita formally told it on 11 May 2023 that its members’ data had been accessed, and it started writing to members the next day.

The ICO says the stolen information ranged “from pension records and staff records to the details of customers of organisations Capita supports”, and that for some people it included “sensitive information such as details of criminal records, financial data or special category data”.

The types Capita listed to the ICO include addresses, email addresses and phone numbers, dates of birth, National Insurance numbers, passport and driving licence details and scans, bank account numbers and sort codes, card details, signatures, health information, and criminal record check details. The ICO adds that “not all these types of data were exfiltrated for each individual data subject”.

That last point is the reason to ask. The list tells you what was possible, not what happened to you. A copy of what your scheme or employer holds, and a direct question about what was in Capita’s systems for you, is how you find out.

Send your request to the scheme. Its privacy notice will name the controller and give an address or email for data requests. Two examples of what you are looking for:

• The Hanson Industrial Pension Scheme’s privacy notice says “The Trustee is the data controller of the personal information to which this notice relates”.
• USS runs a Capita cyber incident hub for its members and gives a data mailbox, mydata@uss.co.uk.

Your scheme can get the detail of what was in Capita’s systems for you from Capita, because Capita was working for it. Ask for both in one letter — the copy of your data, and which of it was involved in the incident. Our free letter builder has a box for that second question; the wording on the data breach page works as written.

Your request goes to Capita plc, the controller for its employees’ data. Its privacy notice gives its data protection officer’s contact:

The ICO’s penalty notice records that one data protection officer acts for Capita plc and all its subsidiaries. Capita’s notice also says that if a message contains both a complaint and a request such as a subject access request, “we will handle each part appropriately” — so the request and the breach question can go in one email. Our letter builder will draft it.

Capita Resourcing. The ICO lists Capita Resourcing Limited as a controller for 417,929 of the records taken. Capita disposed of that business on 31 May 2023, and we have not established who holds that data now. If this is you, ask Capita plc’s data protection officer which organisation now controls it.

Customers of other organisations. Ask the organisation you deal with, not Capita. Our directory has the data protection address for many of them.

Capita offered affected people 12 months of credit monitoring with Experian and set up a call centre. That offer started in 2023 and has run out. Some schemes extended it themselves: the Hanson and Heidelberg Materials schemes added a further 24 months, while USS said Capita would not extend it for its members. Check with your own scheme.

Whatever your scheme offers, the general steps — checking your bank statements and credit report, and treating unexpected calls with suspicion — are on the data breach page.

On 15 October 2025 the ICO fined Capita plc £8 million and Capita Pension Solutions Limited £6 million, £14 million in total. It had first proposed £45 million. Capita admitted liability and agreed to pay without appealing.

The ICO found that Capita had not stopped the attacker escalating privileges and moving across its network, and had not responded effectively to security alerts. Its statement and the full penalty notice set out the detail.

A fine is paid to the regulator. It does not compensate anyone affected.

A group of 3,973 people is suing Capita plc in the High Court, in Spurgeon and others v Capita plc. In February 2026 the court refused Capita’s application to strike the claims out. That decision lets the claims continue; it does not decide them.

We do not handle claims or refer anyone to those who do. What the law says about compensation generally, and why the copy of your own data matters whatever you decide, is on the data breach page.

Time limit. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Complaining. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the ICO, the UK's data protection regulator.