Nearly 8,000 claimants file high court case against Capita over 2023 cyber attack

Outsourcing firm Capita is facing a large-scale lawsuit involving almost 8,000 claimants following a cyber-attack in March 2023 attributed to the Black Basta ransomware group. Manchester-based law firm Barings Law is leading the case, criticizing Capita for handling the breach and delays in informing affected individuals.

Barings Law’s Head of Data Breach, Adnan Malik, described the case as the largest ever filed against Capita. The legal proceedings, initially filed earlier this year, are expected to advance in 2024, though delays in the justice system have postponed the application.

The breach, which occurred between March 22 and March 31, 2023, resulted in unauthorized access to Capita’s network. Capita acknowledged “limited data exfiltration” from compromised servers one month after the attack. Among those affected was the Universities Superannuation Scheme (USS), which manages £82 billion for over 500,000 members. The USS warned its members that their data had been stored on Capita’s compromised servers.

Despite this, Barings Law has criticized the slow response from some pension schemes in notifying their members. Malik noted that individuals continue to receive notifications about breached personal information, such as bank details and employment records, over a year after the incident.

One affected individual, a mining veteran from Yorkshire, only learned about the breach through media reports three months before receiving a letter from his pension provider, the Mineworkers’ Pension Scheme. The scheme has since announced that it will replace Capita with Brightwell as its administrator in January 2025.

While Capita has remained silent on the delays and the ongoing legal proceedings, it continues to hold contracts with other major pension schemes, including the Royal Mail Statutory Pension Scheme (RMSPS), which renewed its £48 million contract with Capita earlier this year.