AskedWith reference to page 58 of the Cabinet Office annual report and accounts 2024-25, published on 23 October 2025, if he will set out the types of personal data reported to the Information Commissioner's Office in each of the eight incidents; and if he will set what types of data were compromised in the Capita cyber-attack.
ReplyPlease see below the data items as recorded on the notification forms to the Information Commissioner’s Office for the eight incidents referred to on page 58 of the Cabinet Office annual reports and accounts 2024-25: Incident 1 - Health, name, contact details, date of birthIncident 2 - Name, account numbers and sort codesIncident 3 - Names, addresses, dates of birth and medical informationIncident 4 - Name, date of birth, home address and brief medical historyIncident 5 - Names, work email addresses, job roles/gradeIncident 6 - Name, Address, National Insurance Number, economic and financial dataIncident 7 - Name, Address, National Insurance Number, economic and financial dataIncident 8 - Name, allegations of improper conduct In the majority of the above reported incidents either individual or very small numbers of data subjects were affected by the breach. Regarding the Capita incident, the types of personal data recorded in the Information Commissioner’s Office notification are as follows:NameContact detailsAccount numbers and sort codesHealth dataEconomic and financial data, e.g. credit card numbers, bank detailsCopies of official documents, e.g. driving licences