NHS England reports GP data breach after Capita cyber-attack

NHS England has reported a data breach involving GP information following a cyber-attack concerning Capita, which affected 90 organisations.

In March, Capita experienced a cyber-attack which caused disruption to its services and initially said that the incident was limited to ‘parts of the Capita network’ and that there was ‘no evidence of customer, supplier or colleague data having been compromised’.

However, in May, the firm admitted that ‘some data was exfiltrated’ and that it would need to spend between £15m and £20m associated with the cyber incident, including specialist professional fees, recovery and remediation costs and investment to reinforce Capita’s cyber security.

The Information Commissioner’s Office encouraged organisations that use Capita’s services to check their own position regarding the incident and determine if the personal data they hold had been affected.

It said that 90 organisations had got in touch regarding the breach, including NHS England, which reported the breach to the ICO after Capita informed them that a document containing ‘limited optometry information’ for two patients was accessed.

Capita also informed NHS England that two files containing names and NHS numbers of deceased and de-registered GP patients were accessed.

In a statement, NHS England said: ‘The files identified archived records that related to individuals who had died more than 10 years ago or who have not been registered with a GP in England for more than 10 years.

‘No health data or other patient data was included in the lists or accessed as a result of the incident.

‘An independent cyber security expert, appointed by Capita, has not found any evidence that the information has been made available more widely.’

Capita said it was ‘working closely with all appropriate regulatory authorities and with customers, suppliers and colleagues’ to notify those affected and take any remaining necessary steps to address the incident.

A Capita spokesperson said: ‘The unauthorised intrusion was interrupted by Capita which resulted in the impact of the attack being significantly restricted.

‘Capita understands now, based on its own forensic work and that of its third-party providers, that some data was exfiltrated from less than 0.1% of its server estate.

‘Capita has taken extensive steps to recover and secure the customer, supplier and colleague data contained within the impacted server estate, and to remediate any issues arising from the incident.’

GPs have experienced numerous problems with Capita’s performance, such as delays with the processing of their pensions at the start of retirement and NHS England said it may split up its primary care support services into separate units from 2025 when the current Capita contract is up for re-procurement.