The UK’s largest outsourcing company has revealed that an attacker likely compromised data during a “cyber incident” at the company in March.
Capita has contracts worth billions of pounds with the UK government and runs important programs for the NHS, HM Prison and Probation Service and the Royal Navy.
In yesterday’s update, the London-based business process outsourcer claimed it had evidence of “limited data exfiltration” from a server compromised by the attackers.
“Based on our research to date, the incident appears to have followed an initial unauthorized access around March 22nd and was interrupted by Capita on March 31st. It may have impacted 4% of Capita’s server assets.”
“Capita will continue to engage in forensic investigations and will notify affected customers, suppliers or colleagues in a timely manner.”
To learn more about ransomware targeting outsourcers, an IT services giant admits $42 million in damages from ransomware attacks.
The company said it worked with third-party forensics experts to determine the cause and scope of the breach, which primarily affected access to internal Microsoft 365 applications.
“Since the incident, Capita and its technology partners have restored access to Microsoft 365 for Capita’s colleagues,” it added. “The majority of Capita’s client services were unaffected by this incident and remain operational, and Capita is currently restoring nearly all affected client services.”
ESET Global Security Advisor Jake Moore argued that ransomware, or at least data extortion, likely explained the motivation for the attack.
“Sensitive data caught in this situation will be held for ransom with the ability to negotiate large sums of money,” he added.
“We’ve been kept secret about whose data was affected for so long that we don’t want the public to know about future communications, especially from organizations like the NHS, government agencies and even the BBC that Capita has dealt with. Calls, text messages, and lifelike emails can all be very easily crafted and deceived people, especially when combined with the corresponding genuine personal information.”
Editorial image credit: T. Schneider / Shutterstock.com
