Capita Tells Staff Hackers Stole Their Private Data in March Attack

UK outsourcing giant Capita is informing staff that hackers indeed snagged some of their private data in March during a cyberattack, including addresses, pension details and national insurance numbers.

Capita is a major outsourcer of business processes and professional services employing some 61,000 people. As previously reported on this blog, the company suffered a cyber-intrusion in March, prompting downtime to internal applications and disrupting services. The firm soon discovered that hackers likely pilfered data from its servers.

The Russia-linked Black Basta ransomware operation was allegedly behind the attack. The group took credit for the breach, only to later delete the announcement from their leak site.

Now, Capita has gone public, confirming that the culprits got ahold of employee data, according to a letter obtained by UK newspaper The Times.

The report says Capita hired a consultant to check that data has not been sold on the dark web, suggesting that the attackers have failed to extort a payment of silence from the outsourcing giant.

In a statement to the Financial Times, Capita said: “We are informing those we have identified to be affected by the incident, and Capita colleagues are being contacted where necessary as part of that process.”

UK news outlet The Register also obtained a few words from the company, but nothing very revealing. Apparently the investigation is still ongoing, months after the incident, due to its “complex” nature.

The latest official update issued by Capita on its newsroom is dated May 10, when the company revealed that hackers had exfiltrated data from less than 0.1% of its server estate – not 4%, as previously estimated.

The outsourcing behemoth expects to spend up to £20 million ($25,6 million) to fully contain the incident, “comprising specialist professional fees, recovery and remediation costs and investment to reinforce Capita’s cyber security environment,” according to the May 10 update.

It also said it had already taken important steps to “ensure the integrity, safety and security of its IT infrastructure to underpin its ongoing client service commitments.”