Fallout from Capita data breach widens as local councils launch probes

Featured Sponsor

Store	Link	Sample Product
UK Artful Impressions	Premiere Etsy Store

The aftermath of Capita’s second data breach is widening, with five other local councils confirming their files were at risk in an insecure cloud-based data storage system.

The revelations come after Colchester council announced on Wednesday of a ‘major data breach’ in which details of its residents’ benefits were left exposed on a unprotected Amazon Data Bucket controlled by Capita.

Towns including Coventry, Adur and Worthing in West Sussex, Rochford district and South Staffordshire said their data was also left exposed. Coventry said it was “belatedly notified that there has been a potential historical data breach by our financial services contractor Capita”.

“We are extremely concerned and disappointed by this news, not only because we take these matters very seriously, but also because of the time it has taken to alert us,” the council added.

Capita, one of the UK’s largest IT and data outsourcers managing government contracts and private pension schemes, provides a range of services to local government, including benefits administration and tax collection.

The outsourcer was hit by a cyber attack in March. The UK’s largest private sector pension scheme, the Universities Superannuation Scheme, has warned that the personal details of around half a million members may have been stolen during the hack.

Adur and Worthing councils, who were briefed on the latest incident this week, were advised by Capita that personal information had not been lost, but officials said they were launching their own investigations into the incident.

Rochford Borough confirmed ‘insecure storage of personal data by its revenue and benefits software provider, Capita’, adding it was working with the outsourcer to understand how the data transfer from the agency.

South Staffordshire said it had been made aware of a “potential problem” with Capita “related to data storage”. “The full extent of the problem is not yet fully known. However, we have been assured that a full investigation is ongoing, the outcome of which will determine our next steps,” the council added.

The Information Commissioner’s Office, the data protection regulator, said several councils had reported the incident and it was “evaluating the information provided”.

Robin Speakman, an analyst at Shore Capital, said he was concerned Capita could lose contracts due to its data breaches. “If you are the C-suite executive [deciding] whether to stay with Capita or move elsewhere, if you stay with Capita and things don’t get better [or] if you get it wrong again, you could be criticized for it,” he said.

Capita said it was working with “third-party technical advisers to investigate” the latest disclosure of a data breach involving local councils, adding that historical data was “secure and no longer accessible”.