Capita settles cyber-attack case with ICO for £14m, revises cash flow

Investing.com -- Capita has reached a settlement with the Information Commissioner’s Office (ICO) regarding the March 2023 cyber-attack, agreeing to pay a £14 million penalty.

The ICO initially proposed a £45 million penalty but reduced it to acknowledge Capita’s cooperation during the investigation. Following the incident, new CEO Adolfo Hernandez has accelerated the company’s cybersecurity transformation with new leadership and significant investment.

The company conducted a detailed forensic investigation after the attack and contacted all individuals potentially impacted.

Due to this settlement, Capita has revised its financial guidance for 2025. The company now expects a free cash outflow before business exits of between £59 million and £79 million, compared to the previous guidance of £45 million to £65 million.

Despite this adjustment, Capita maintains its expectation to become cash positive by the end of 2025. The company’s full-year 2025 guidance and medium-term targets remain unchanged.

"Whilst unfortunate, this draws a line in the sand, and we believe Capita has handled the incident as well as could have been hoped. We remain positive, and believe there are a number of positive potential catalysts over the next 12 months," according to analysts at RBC Capital Market.

The company anticipates returning to positive free cash flow by the end of this year as EBITDA increases, restructuring costs decrease, and deferred income unwind reduces.

Additionally, Capita Public Service is expected to demonstrate sustainable organic revenue growth through the second half of 2025 and into 2026. The company also anticipates profit recovery in its Contact Centre business.

Capita continues active negotiations regarding an exit from the remaining closed book L&P contract, which currently costs £20 million in annual cash outflow.

This article was generated with the support of AI and reviewed by an editor. For more information see our T&C.