Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The UK Information Commissioner’s Office (ICO) fined Capita plc £8 million and Capita Pension Solutions Limited (CPSL) £6 million after finding that security failures allowed attackers to steal data relating to 6,656,037 people in a March 2023 cyberattack. The ICO said weak controls over administrator privileges and network movement, a delayed response to a high-priority alert, and gaps in how security testing findings were addressed contributed to the breach. The two companies accepted the findings and agreed not to appeal under a voluntary settlement.
What happened in the Capita cyberattack?
According to the ICO’s account, the incident began on 22 March 2023, when an employee unintentionally downloaded a malicious file. A high-priority alert was raised within ten minutes, but the device was not quarantined for 58 hours. Attackers used their access to deploy malicious software, obtain administrator permissions and move into other parts of Capita’s network.
Nearly one terabyte of data was exfiltrated between 29 and 30 March. Capita became aware of the attack on 31 March, when ransomware was deployed. The ICO’s detailed announcement and penalty notice describe a March 2023 incident; a brief enforcement listing labels it April 2023, a discrepancy with those more detailed records.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What data was affected, and how many people were involved?
The ICO’s monetary penalty notice says data relating to 6,656,037 individuals was exfiltrated across the Capita Group. It included pension and staff records, as well as information about customers of organisations supported by Capita. Some records contained financial information, criminal-record details or special-category personal data.
#1 Best Overall
CPSL processed data for more than 600 organisations providing pension schemes; 325 of those organisations were also affected. The ICO received at least 93 complaints about the attack and said many people reported anxiety and stress.
Why did the ICO fine Capita £14 million?
The ICO found that Capita did not have adequate security measures to prevent attackers from escalating privileges and moving laterally through its network. The regulator said vulnerabilities in these areas had been raised at least three times but were not remedied.
The response to the alert was another central concern. Although the alert was marked high priority within ten minutes, Capita took 58 hours to respond appropriately, despite a one-hour target. The ICO said the Security Operations Centre was understaffed and had missed target response times in at least six months before the incident.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteThe ICO also found that systems holding millions of records, including sensitive data, were penetration-tested when commissioned but not tested again afterward. Findings remained siloed within business units, preventing risks to the wider network from being addressed consistently.
The monetary penalty notice gives different infringement periods for the failures: inadequate prevention of privilege escalation and lateral movement from 25 May 2018 to 31 March 2023, and ineffective response to security alerts from 1 September 2022 to 31 March 2023.
How was the £14 million penalty divided?
| Entity | Role assessed by the ICO | UK GDPR provisions found infringed | Final penalty |
|---|---|---|---|
| Capita plc | Data controller | Articles 5(1)(f), 32(1) and 32(2) | £8 million |
| Capita Pension Solutions Limited (CPSL) | Data processor | Articles 32(1) and 32(2) | £6 million |
The ICO said each entity was responsible for its own compliance, even though the group applied the same security measures. The final amount followed Capita’s representations and a voluntary settlement reduction. The provisional penalty the ICO had told Capita it intended to impose was £45 million; after considering representations and mitigation, the parties settled on £14 million. Both entities accepted the findings and agreed not to appeal.
What support did affected people receive?
Capita offered affected customers 12 months of credit monitoring through Experian and established a dedicated call centre. The ICO said more than 260,000 people activated the monitoring service. This is a historical remedy recorded in the ICO’s decision; the decision does not establish whether the offer remains available now.
What security lessons did the ICO draw?
The ICO’s lessons from this investigation focus on organizational controls rather than any single measure guaranteeing that an incident can be prevented:
- Apply least-privilege access and follow National Cyber Security Centre (NCSC) guidance intended to reduce lateral movement.
- Monitor for suspicious activity and respond to security alerts promptly, with staffing and escalation processes that support response targets.
- Share penetration-test findings across the organization and ensure identified risks are addressed and checked again.
- Invest in security controls and verify that they work in practice.
- Review how security responsibilities are divided between data controllers and processors.
The case illustrates why a control cannot be treated as effective merely because it exists on paper: alert handling, access restrictions and remediation need to work across the systems and teams that hold or protect personal data.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
