Update on USS Capita data breach

I wanted to provide you with an update on the work being undertaken following the announcement by USS on 12 May 2023 that details of USS members were held on Capita servers accessed by hackers in March 2023.

USS have confirmed that information potentially accessed included:

• Title, Initial(s), Name; Date of Birth; National Insurance number; USS member number. 

USS have set up a Capita cyber incident hub and we encourage all members to access this site and take all necessary advice and action to protect their identity - don't fall for a pension scam.

USS have confirmed that members will be given access to identity protection service, free of charge, through Experian and we would encourage members to access this service with the following link. Although identity theft (which is essentially what Experian can warn of) is one way members can be attacked, using this information to scam members by contacting them directly is a more likely direction. We would encourage all USS members who have not already done so to use the Experian voucher and access the link.

UCU met USS on Friday 23 June 2023 when the data breach was discussed. We remain concerned at the level of information provided to USS by Capita and what due diligence processes were in place to protect members' personal information. We know that USS has taken measures to minimise the impact of this breach on members and that they continue to engage Capita for more information on the breach. Capita are currently completing a full examination of the breach and this risk assessment will be shared with USS and the Information Commissioner's Office (ICO) when completed. UCU have also asked for this information. 

We have also engaged the ICO directly who have informed us that they will not decide on whether to carry out their own investigation of the breach until they receive the risk assessment from Capita. We continue to engage the ICO on this and what other options are available for members.

For now, our advice to members is simple - sign up for the Experian voucher and do not disclose any further information online if asked. Only engage with legitimate queries once you have confirmed the identity of the contact. Legitimate contacts will not be annoyed if you question them.

With best wishes

Dooley Harte
UCU pensions official (USS)