Capita, a business process outsourcer that handles the data of millions of people, was targeted in a cyber-attack at the end of March. The attack revealed that Capita had been leaving much of its data in unsecured cloud servers online. 

Now, the number of companies reporting data breaches to the ICO in connection to Capita is around 90. Capita says it has taken the appropriate steps to secure the data. 

The ICO is now warning that thousands of people could have been affected by the hack. “We are receiving a large number of reports from organisations directly affected by these incidents and we are currently making enquiries,” said the ICO in a release.

“We are encouraging organisations that use Capita’s services to check their own position regarding these incidents and determine if the personal data they hold has been affected,” it continued. 

The ICO is urging organisations to notify them within 72 hours of becoming aware of a personal data breach, unless it does not pose a risk to people’s rights and freedoms. However, if an organisation decides the breach does not need reporting, organisations should keep a record of it to be able to explain why it wasn’t reported if necessary. 

Breach reports can be submitted here.

Recommended

• NHS Trusts Shared Patient Data with Meta
• Capita Faces More Backlash After New Cloud Data Leak
• Capita Outage Confirmed a Cyber-attack

The attack and unsecured data

Capita first came into the limelight when it was the victim of a cyber-attack on 31 March. A Capita employee revealed to the Guardian that they were unable to log into their laptops. 

Later, Capita released a statement that there was a cyber-incident which impacted its internal Microsoft Office 365 applications. The company claimed at the time that there was no evidence of customer, supplier, or colleague data having been compromised. 

Earlier this month Capita came under scrutiny once again when it was revealed that it had left a repository of files unsecured online. The unsecured data included that of local authorities such as Colchester council.

“We are extremely disappointed that such a serious data breach by one of our contractors has occurred,” said Richard Block, Colchester City Council’s Chief Operating Officer.

Capita is one of the largest suppliers for the UK public sector, and provides supplies for many military institutions as well as the NHS, and is contracted for HM Revenue and Customs.