Capita’s data breach fallout widens as local councils launch probes

The fallout from Capita’s second data breach is widening, with five more local councils confirming their files had been put at risk in an unsecured cloud-based data storage system.

The revelations come after Colchester council’s announcement on Wednesday of a “serious data breach” where benefits details of its residents were left exposed on an unsecured Amazon Data Bucket that was controlled by Capita.

Councils including Coventry, Adur and Worthing in West Sussex, Rochford District and South Staffordshire said their data had also been left exposed. Coventry said it had “been belatedly informed that there has been a potential historic data breach by our financial services contractor Capita”.

“We are extremely concerned and disappointed by this news, not just because we take such matters very seriously, but also the length of time it took to alert us,” the council added.

Capita, one of the UK’s largest IT and data outsourcers handling government contracts as well those for private pension plans, is a provider of a range of services to local government, including the administering of benefits and the collection of taxes.

The outsourcer was hit by a cyber attack in March. The UK’s biggest private sector pension plan, the Universities Superannuation Scheme, warned that the personal data of about half a million members may have been stolen during the hack.

Adur and Worthing councils, which were informed of the latest incident this week, were told by Capita that personal information had not been lost, but officials said they were launching their own investigation into the incident.

Rochford District confirmed the “unsafe storage of personal data by its revenues and benefits software supplier, Capita”, adding that it was working with the outsourcer to understand how the data beach from the company had occurred.

South Staffordshire said it had been made aware of a “potential issue” with Capita “relating to the storage of data”. “The full extent of the issue is not yet fully known. However, we have been assured that a full investigation is under way — the outcome of which will determine our next steps,” the council added.

The Information Commissioner’s Office, the data protection regulator, said several councils had reported the incident and it was “assessing the information provided”.

Robin Speakman, analyst at Shore Capital, said he was concerned that Capita would lose contracts from its data breaches. “If you are the C-suite executive [deciding] whether to stick with Capita, or move somewhere else, if you stick with Capita and things don’t improve [or] go wrong again, you could be criticised for that,” he said.

Capita said it was working with “third-party technical advisers to investigate” the latest revelation of a data breach involving local councils, adding that the historic data was “secure and no longer accessible”.