Capita has been reported to the information commissioner by the Cabinet Office over a data breach in the civil service pension scheme.

The outsourcing company is now fighting to retain its £239 million contract administering hundreds of thousands of pensions.

Capita was referred to the regulator over a data breach in early April that led to pensioners receiving access to other members’ details.

Business newsletter

The business editor’s exclusive analysis of all the latest financial and economic news.

Sign up with one click

Concerns have been raised about Capita’s ability to run the pension contract effectively after processing issues blocked pensioners from accessing their retirement savings. Government departments have been handing out interest-free loans to recent retirees facing financial difficulties, with the total value of lending now standing at more than £7 million.

It is understood that the glitch occurred when Capita introduced new functions to its software platform. Nick Thomas-Symonds, the Cabinet Office minister, has demanded Capita restore service levels by the end of June, and said the government will “use every commercial lever at our disposal” to ensure targets are met. 

Capita’s contract with the Cabinet Office is worth £239 million over a seven-year period, with an option to extend for a further three years. The total number of members in the retirement programme is 1.7 million, of which about 740,000 are receiving payments.

Capita took over the contract from MyCSP in December. It said it took on a backlog of more than 80,000 cases.

A spokeswoman for the information commissioner said: “The Cabinet Office reported an incident to us and we are assessing the information provided.” 

One source told The Times that the latest data breach was particularly concerning given Capita’s history of information leaks, most notably in a cyberattack that compromised the data of 6.6 million people in 2023 and led to a £14 million fine for the company. The source said the more recent issues were “not as drastic” as that cyberattack but were “clearly a sign that Capita data security has not improved”.

Adolfo Hernandez, chief executive of Capita, said in response to the group’s fine that management had invested heavily to prevent another breach and had installed “new digital and technology leadership”. He added: “As a result, we have hugely strengthened our cybersecurity posture, built in advanced protections and embedded a culture of continuous vigilance.” 

Capita was recently stripped of its £48 million contract to run the Royal Mail pension scheme after failing to meet targets. One source said the Cabinet Office was “very angry” with Capita and “making it very clear that they are not running a good system”.

Capita said: “We have been working together with the Cabinet Office for several months to reduce the backlog and are taking all necessary steps to address this. Additional staff have been trained and deployed, and our focus is on ensuring members of the civil service pension scheme receive the service they expect and deserve, in line with the plan agreed with the Cabinet Office.”