Regular monitoring and updating of the Technical and Organizational Measures

The UK Information Commissioner's Office (ICO) has fined the service provider Capita £14 million. The reason: inadequate security measures, which led to a massive hacker attack in March 2023. Sensitive pension records, personnel files, and customer data from hundreds of organizations were stolen. According to the authority, Capita, a major provider of outsourcing and IT services, had not taken sufficient Technical and Organizational Measures. The cyberattack was triggered by an employee accidentally downloading a malicious file. Although a security alert was quickly received, it took 58 hours for the affected device to be isolated – enough time for the attackers to install malware, gain administrator rights, and steal almost a terabyte of data.

The investigation revealed several fundamental shortcomings in security measures and organizational controls: There was no tiered authorization model for administrator accounts. Warnings were not dealt with promptly because the Security Operations Center was understaffed, and penetration tests were not carried out regularly or evaluated company-wide.

This decision underscores the importance of adequate TOMs and an emergency plan for IT security incidents.

Should you have any questions or require further information, please do not hesitate to contact us any time.