Capita reaches settlement with ICO regarding 2023 cyber attack

Capita today announces it has reached a settlement with the Information Commissioner’s Office (ICO) in respect of its findings regarding the March 2023 cyber attack. The settlement includes a penalty of £14m.

Capita is committed to upholding the security of its data and protection of our systems for our clients and their customers. We regret the incident and can reaffirm that, following a detailed forensic investigation, all those identified as potentially impacted were contacted after the attack.

Adolfo Hernandez, Chief Executive Officer, Capita said:

“As an organisation delivering essential public services as well as key services for private sector clients, Capita was among the first in the recent wave of highly significant cyber-attacks on large UK companies.

“When I joined as CEO the year after the attack I accelerated our cyber security transformation, with new digital and technology leadership and significant investment. As a result, we have hugely strengthened our cybersecurity posture, built in advanced protections and embedded a culture of continuous vigilance.

“Following an extended period of dialogue with the ICO over the last two years, we are pleased to have concluded this matter and reach today’s settlement. The Capita team continues to focus tirelessly on our Group transformation journey for the benefit of our customers, our people and wider society.”

Reflecting the impact of the £14m penalty, we now expect free cash outflow before the impact of business exits of between £59m- £79m, with no other changes to the previous guidance of £45m- 65m. We continue to expect to be cash positive from the end of 2025. Our full year 2025 guidance, together with our medium-term targets also remain unchanged.