Lord Lake granted permission for Philip Mark Bull, as the representative party, to bring group proceedings against outsourcing giant Capita PLC at the Court of Session. Jones Whyte is leading the action on behalf of the group.

Lord Lake granted two significant orders. First, permission was granted for the Capita Group Proceedings to be brought against Capita PLC in relation to claims arising from the March 2023 cyber incident. Second, the application for the appointment of a representative party was granted – authorising a named individual to lead the action on behalf of everyone affected by the same breach.

This action follows a ransomware attack in March 2023 in which hackers gained unauthorised access to Capita’s IT systems and stole copies of personal data belonging to an estimated 6.6 million individuals. Data compromised in the breach is reported to have included names, dates of birth, National Insurance numbers, and pension scheme membership details. In October 2025, the Information Commissioner’s Office fined Capita a combined £14 million for failing to implement appropriate security measures under the UK GDPR.

Capita’s clients span a wide range of major employers and institutions – including M&S, O2, BAE Systems, Diageo, Direct Line Group, the Universities Superannuation Scheme and Scottish Power – many of which relied on Capita to administer pension schemes on their behalf.

Dominic Ritchie, partner, Jones Whyte, said: “This is the moment affected individuals in Scotland have been waiting for. The data stolen in this breach was deeply personal – including pension details, National Insurance numbers, and dates of birth. The impact on those affected has been very real, and today’s ruling gives them a genuine path to compensation.

“We would urge anyone who believes they may have been affected not to delay and to come forward as soon as possible to give themselves the best opportunity to pursue compensation.”