Outsourcing giant Capita fears its customers’ data could be stolen in a ransomware attack

Capita, the UK outsourcing company that provides essential services to the UK government, says hackers may have accessed customer data in a cyberattack last month.

The London-based outsourcing giant, whose clients include the NHS, the British military and the Department for Work and Pensions, said in a statement on Thursday that its investigation into the March attack had uncovered evidence of “limited data exfiltration” which “could include customer, supplier or colleague data.

Capita did not specify how many customers were affected or what types of data were accessed. Russ Lynch, an agency spokesperson representing Capita, told TechCrunch the company would not comment beyond its statement.

However, a Sunday Times report claimed that the Russian-speaking ransomware group Black Basta, which claimed responsibility for the attack, released personal bank details, passport photos and addresses, as well as personal data belonging to the teachers applying for jobs in schools.

The gang is also believed to be responsible for the recent attack on US satellite TV provider Dish.

At the time of writing, Capita is not listed on the Black Basta dark web leak site, which ransomware groups typically use to extort companies into paying a ransom demand for not releasing stolen data. .

captain first confirmed that he had suffered a “computer glitch” in late March, before later admitting on April 3 that a “cyber incident” was behind the disruption, which prevented staff from accessing his VPN to sign in and to Microsoft 365 services. At the same time, Capita said he had “no evidence that customer, supplier or co-worker data has been compromised.”

The cyberattack also disrupted some services that Capita provides to customers. Reports claim that local authorities, such as Barnet Council in London, have experienced disruption to customer service lines, and businesses that use Capita for call center services, such as the O2 cellular network, have also been affected.

UK government services have also suffered disruption, according to Cabinet Office spokesman Conor Walsh, who told TechCrunch the incident “mainly affected internal processes with minimal impact on departments”.

“We are aware of the cyber incident that affected Capita and continue to be in regular contact with the company,” the spokesperson added. Capita holds £6.5bn ($8bn) in public sector contracts, according to The Sunday Times.

In its latest update, Capita said it has now restored “virtually all customer services that were impacted” and said it has restored employee access to Microsoft 365.

Thursday’s statement also confirms that the hackers first compromised Capita’s internal systems on March 22, about nine days before Capita “stopped” the breach on March 31.

“Due to the outage, the incident was significantly limited, potentially affecting approximately 4% of Capita’s server farm,” the statement said. “Capita continues to conduct its forensic investigations and will notify any affected customers, suppliers or colleagues in a timely manner.”

The Information Commissioner’s Office, which enforces UK data protection laws, confirmed to TechCrunch that “Capita has reported an incident to us and we are assessing the information provided.”