Capita data breach

Were you affected by the Capita pension cyber-attack?

Check if you may have been affected and register for updates.

Capita provides outsourced pension administration services to hundreds of schemes across the UK. In March 2023, it suffered a cyber attack that led to the theft of personal data relating to millions of people, including pension scheme members and beneficiaries.  

In October 2025, the Information Commissioner’s Office (ICO) fined Capita £14 million after concluding that the personal data of around 6.6 million people had been exposed and that the incident could have been prevented if appropriate security measures had been in place.

In February 2026, the High Court refused an attempt by Capita to strike out nearly 4,000 data breach claims. The court ruled that the claims can proceed, although no findings on liability or compensation have yet been made.

We have previously worked with a specialist group action law firm on this case and continue to monitor developments.

Can you join the claim?

The claim is currently closed to new claimants. You may still be affected if:

Register for alerts so we can notify you if registration reopens.

What happened in the Capita Cyber attack?

The Capita incident is widely reported as a ransomware cyber attack that began in March 2023, when attackers gained access to Capita systems and stole data.

Capita has said the incident disrupted some client services and involved unauthorised access to certain IT systems.

What data may have been exposed?

The data involved can vary by scheme and individual. This could include:

• Name and contact details
• Date of birth
• National insurance number
• Pension-related information
• In some cases, financial details (for example, bank details)

If you received a notification letter/email, it should tell you the categories of information that may have been impacted in your case.

Brands and pension schemes that may be involved

Following the ICO’s £14 million fine, we submitted a Freedom of Information request to obtain the complete list of 325 pension schemes it said were affected.

The ICO told us it does not hold a list of the affected schemes. It confirmed that Capita provided the number of affected data controllers, but no complete list has been made public.

While we don’t yet know the full extent of every organisation affected, scheme communications and court documents have revealed a number of schemes and employers, including:

• Anglian Water
• AXA UK Group Pension Scheme
• BAE Systems
• Boots
• British American Tobacco
• Canon Retirement Benefit Scheme
• DHL
• Diageo Pension Scheme
• Environment Agency Pension Fund
• Greene King
• Marks & Spencer Pension Scheme
• Metropolitan Police
• Mineworkers Pension Scheme
• Morrisons
• National Grid
• National Trust (Capita-administered Scheme)
• NHS England
• Nissan Pension Scheme
• Northumbrian Water
• O2
• Pfizer Pension Trustees
• Plusnet
• Procter & Gamble Pension Fund
• PwC Pension Scheme
• Rothesay Pension Scheme
• Royal Mail
• Samsung
• Scottish Power
• Severn Trent Water
• Sopra Steria Retirement Benefits Scheme
• Southern Housing Group
• Tarmac Pensions Limited
• Unilever Pension Scheme
• Universities Superannuation Scheme (USS)
• Volkswagen Group UK

If your scheme or employer isn’t listed, you may still be affected. The clearest indicator is whether you received a notification confirming your data was involved.

Protect yourself after a data breach

If your personal data was exposed, it’s sensible to take precautions:

Read our guide: Protecting yourself following a data breach.