2023 Capita — 6.6M, ransomware + unsecured storage
Data compromised
Names, DOB, NI numbers, passports, emails, addresses
Technical writeup
Ransomware via malicious JS on employee device. Second breach: unsecured files online. 6.6M individuals; health, criminal records. 90 orgs notified ICO. USS pension, Royal Mail, Axa affected. ICO fined £14M in 2025.
Root cause
Ransomware; misconfiguration; inadequate security