The UK Information Commissioner's Office found that a high priority alert fired within 10 minutes of the Capita intrusion, yet the infected device was not quarantined for 58 hours against a one hour target. The detection worked. The response did not, and that gap sits at the center of the 14 million pound penalty.
What the ICO says happened
The ICO's published account says the attack began on 22 March 2023 when an employee downloaded a malicious file. Between 29 and 30 March, nearly one terabyte of data was taken. On 31 March ransomware was deployed and all user passwords were reset, which locked staff out of their own systems.
Around 6.6 million people were affected. The penalty was split between Capita plc as controller (8 million pounds) and Capita Pension Solutions Limited as processor (6 million pounds). The ICO first proposed 45 million pounds and reduced it after weighing Capita's representations, its improvements after the attack, and the support it offered to affected people. Capita admitted liability and did not appeal.
The response failure in plain terms
Two facts in the ICO text matter for any security team. First, the alert was high priority and arrived in minutes. Second, the Security Operations Centre was understaffed and had missed its target response times for at least six months before the attack.
That second fact changes how you read the first. A 58 hour delay is not one bad night. It is what a queue looks like after months of missing targets with nobody treating the miss as a risk.
What to measure in your own team
If you run detection and response, three numbers tell you whether you are exposed to the same pattern:
- Time from alert to a human acknowledging it, split by severity.
- Time from acknowledgement to containment of the affected device or account.
- The share of high priority alerts that missed your own target in the last 90 days.
Report the third number to someone who can add headcount or change scope. A SOC that quietly misses its targets for six months has already told you what a real incident will look like.
Make containment a pre-approved action
Containment often waits on a person who has to ask permission. Decide in advance which actions need no approval, for example isolating a single endpoint from the network when a high priority malware alert fires. Write it into the runbook, test it, and record who may trigger it out of hours.
Pair that with a rule for what happens when the on-call analyst cannot be reached. An alert that nobody owns for an hour should page a second person automatically.
Where this fits with the other findings
The ICO also pointed to administrative accounts without a tiering model and to penetration test findings that stayed inside business units. Fast response limits the damage after those weaknesses are used, but it does not replace fixing them. Treat the 58 hours as the symptom and the staffing and ownership gaps as the cause.
Safeguard's policies, gates and guardrails and its compliance and evidence automation can help you show that response targets exist and are tracked, though staffing a SOC remains your decision.
Quick check
Was Capita fined because it was attacked?
No. The ICO's findings were about security failings under UK GDPR, including slow response to an alert, privilege design and testing practice, not the fact that an attacker got in.
What was the target response time that was missed?
The ICO states the target was one hour and the device was quarantined after 58 hours.
Sources
Last reviewed: 19 October 2026.
