Members of Marks and Spencer Group PLC (LSE:MKS) and Diageo PLC (LSE:DGE) pension schemes may have had personal data stolen when Capita PLC (LSE:CPI) suffered a cyber-attack in March.
The supermarket group and alcoholic beverage company used Capita for its pension administration services, just like hundreds of other private-sector retirement schemes.
Marks and Spencer’s pension scheme confirmed on Thursday that a “large proportion” of scheme members’ personal data had been affected by the outsourcer's attack, including most pensioners who had worked for the organisation.
A statement on the M&S pension scheme website read: “Capita cannot be certain that this data has been accessed, but we believe it’s appropriate to act as if this is the case and warn affected members about the potential risks.
“There is the possibility that if personal data is accessed it could be used for fraud, identity theft or to send malicious emails.”
The retailer, as of 2021, had 106,000 members in its pension scheme, 53,000 of those being pensioners.
Diageo, which has around 32,000 pension members, also confirmed it was affected by the attack and said it would be working with Capita to understand the extent of the hack.
The news comes after USS, the UK’s biggest private sector pension plan, confirmed that the personal details of 470,000 members were on the Capita servers that were compromised by the attack.
Earlier in May, the outsourcing experts said it expected to lose between £15mln to £20mln because of the attack.
Shares in Capita have dropped over 2% since it announced in late April that it suffered the attack.