UK Civil Service Pension Scheme Suffers Data Breach, Exposing Members’ Financial Data A data breach in the UK Civil Service Pension Scheme (CSPS) has exposed the financial information of nearly 140 members after a flaw in its online portal, managed by outsourcing firm Capita, allowed users to view others’ personal annual benefit statements (ABS). The incident occurred on 30 March 2026, when the portal malfunctioned for approximately 35 minutes, incorrectly displaying ABS documents to unauthorized users. Capita swiftly suspended the ABS functionality upon discovery and launched an investigation. The company confirmed that all affected members were notified on 3 April, while those who did not receive communication were unaffected. A Capita spokesperson stated that the breach was contained quickly, emphasizing the firm’s commitment to data protection, though the portal remains offline pending remediation. The UK Cabinet Office acknowledged the incident, describing it as a serious matter despite the limited number of impacted individuals. Officials are working with Capita to assess the breach and determine further steps. Meanwhile, Unite union national officer Dominic Hook criticized Capita’s handling of public sector pensions, citing the breach as further evidence of the risks of outsourcing and urging the government to fulfill its manifesto pledge to bring such services back in-house. The breach follows a series of high-profile cyber incidents, including a 2025 surge in healthcare data breaches and the 2024 Qilin ransomware attack on Synnovis, which compromised NHS patient data. The CSPS incident underscores ongoing vulnerabilities in third-party-managed systems, particularly those handling sensitive financial and personal information.