Capita claim none of the exfiltrated data was available on the dark web - which is actually false if you read this thread, The Times got data from the portal and called the victims (teachers Capita vetted).
Nevertheless, the ICO doesn’t agree anyway - there is still a risk of harm even if you pay the ransom and try to cover up the data theft, basically.