Thousands of people affected by the 2023 Capita cyberattack have moved a step closer to justice, after a High Court judge ruled that the group legal action against Capita can continue. In a decision handed down on 9 February, the court rejected Capita’s attempt to stop the case. This means the claims will now move forward through the legal process.
What the court decided
Capita had argued that the claims brought on behalf of more than 8,000 people should be dismissed because the evidence relied on “generic” descriptions of anxiety and distress following the breach.
The court disagreed. The judge said it would be extreme to strike out the claims at this point, especially in a case involving thousands of people affected by the same incident.
As a result, the legal action against Capita will now continue to the next stage.
This decision is being seen as an important moment for large-scale data breach claims in the UK.
Why this ruling matters
This ruling does not mean Capita has been found responsible, or that compensation will definitely be paid. What it does mean is that the case cannot be shut down before the evidence is properly examined.
In practical terms, it means:
- Claims for distress caused by a data breach are not invalid just because many people report similar experiences
- Large group claims can move forward without each person having to provide completely unique evidence at the outset
- Companies facing mass data breach claims may find it harder to shut cases down early on technical grounds.
For people affected by the Capita breach, it keeps the case alive and allows their experiences to be considered by the court.
A reminder of what happened
Capita provides administration and support services to hundreds of UK pension schemes and employers.
In March 2023, it was hit by a ransomware attack that exposed the personal data of around 6.6 million people. The compromised data is understood to include sensitive financial and pension information.
Following an investigation, the Information Commissioner’s Office concluded that Capita had failed to put appropriate security measures in place.
In 2025, the ICO fined Capita £14 million, stating that personal data had been left at “significant risk”. That fine was originally set at £45 million but later reduced.
This part often causes confusion. ICO fines are designed to punish organisations and improve standards, not to compensate individuals. The £14 million paid by Capita goes to the UK Treasury, not to the people affected. The ICO has no power to pay compensation to victims.
If compensation is awarded, it will only come through the courts or a settlement reached as part of any legal action.
What happens next in the Capita claim
For now, the ruling simply confirms that the Capita data breach claims can proceed.
For those affected, this means:
- The case is still ongoing
- Legal scrutiny of Capita’s handling of personal data will continue
- Compensation remains a real possibility.
If you were notified by Capita, your employer, or a pension provider that your data may have been involved you will not receive compensation automatically. However, you may be able to join a group legal action.
Join the Claim connects consumers with SRA-regulated lawyers. Visit the claim page to check your eligibility if a claim is open with one of our trusted legal partners. If a group action has not yet been launched, you can register your interest and we’ll keep you informed if a partner firm decides to take a claim forward.
