Capita handed £50m London police contract weeks after losing pension data

The City of London Police has awarded Capita a lucrative £50 million ($63 million) contract for digital services just weeks after the firm admitted it may have lost the pension data of half a million people in a security breach. 

Capita will create a customer management process for the end-to-end handling of communications by potential fraud victims and offer new multilingual language channels.

It will also implement speech analytics for call quality and provide empathy training for customer-facing employees.

“We are incredibly proud to be chosen to deliver the new fraud reporting service for City of London Police, and are focused on providing an empathetic and seamless service for all potential victims of fraud,” said Jon Lewis, CEO at Capita.

“This new contract is testament to our proven track record of delivering digitally enabled customer management for citizens – including some of the most vulnerable people in society – and reflects our commitment to delivering an outstanding service to our public sector clients.”

In total, the contract is worth £70 million ($88 million) across seven years, with an initial five-year period followed by a possible two-year extension.

Capita has previously also provided services for the NHS, Royal Navy, and worked on the IT infrastructure for London’s Ultra-Low Emission Zone (ULEZ).

Capita’s breach in brief

The news follows weeks of repeated updates on the scale of a cyber attack against Capita by the ransomware group Black Basta, in which sensitive information was stolen.

Capita first admitted it had suffered a breach affecting 4% of its servers in April, with initial compromise having taken place on 22 March 2023.

In May, the firm told a UK pension provider USS to ‘assume’ almost 500,000 customers had been impacted by the breach, including national names, addresses, and insurance numbers.

Just days prior, Capita indicated that the attack could cost it up to $25 million.

The firm has been criticized for its handling of the breach, having first stated in March there was “no evidence” that a breach had occurred before later stating that “some evidence of limited data exfiltration” had been found.

Its handling of the cyber attack may damage the company image going forward, with customers forced to wait weeks before being given the full picture of the data theft.