Approximately 90 organisations have reported breaches of personal data held by Capita, the UK-based provider of business process outsourcing solutions and professional support services, reports BBC News, citing data from privacy watchdog Information Commissioners Office (ICO). The company suffered a cyber-attack in March this year. In an April update, the group said the incident caused disruption to some services provided to individual clients, though it added that the majority of its client services remained in operation.

According to the ICO, Capita had left a pool of data unsecured online and hundreds of thousands of people are now being warned that they could have been affected by the hack. Capita says it has taken steps to secure the data. The company stated that it “continues to work closely with specialist advisers and forensic experts to investigate the cyber incident and we have taken extensive steps to recover and secure the data."

Security researcher Kevin Beaumont told the BBC the March cyber incident, which he is ‘very confident’ was a ransomware attack, was significant because of the breadth of data potentially at risk which could expose victims to fraud. Beaumont alerted Capita to the second issue, which left files unsecured online, in April but it only emerged publicly the following month. A number of local government councils have said they believe personal data was put at risk, although Capita initially told journalists it did not believe that this was the case.

Capita told the BBC, "We have worked quickly to provide our clients with information, reassurance and support, while delivering for them as a business. In instances where we need to provide further support to those affected, we will do so." It added the data exposed online in the second incident "was secure and no longer accessible and our investigations into this matter are ongoing."