Black Basta ransomware attack to cost Capita over £15m

UK outsourcer and public sector specialist Capita expects to incur “exceptional costs” in the region of £15m to £20m as a result of the March 2023 Black Basta ransomware attack on its systems, which saw clients left unable to provide vital public services for days, and has resulted in a major breach of customer data, including information held by pensions providers.

In a statement to the market issued 10 May, Capita said that these costs would include specialist professional feed paid to cyber security incident responders and forensics, recovery and remediation costs, and investment to reinforce Capita’s cyber security environment.

The organisation did not mention the impact of any regulatory penalties that may or may not arise over the apparent loss of significant amounts of data, some of which is known to have been circulating on the dark web. Nor did it say whether or not it has paid off the Russian-speaking Black Basta gang.

“Capita has continued to work closely and at speed with specialist advisers and forensic experts to investigate and resolve the cyber incident,” a spokesperson said.

“As noted previously, the unauthorised intrusion was interrupted by Capita which resulted in the impact of the attack being significantly restricted. Capita understands now, based on its own forensic work and that of its third-party providers, that some data was exfiltrated from less than 0.1% of its server estate.

“Capita has taken extensive steps to recover and secure the customer, supplier and colleague data contained within the impacted server estate, and to remediate any issues arising from the incident.”

Capita said it would continue to work closely with regulators, customers, suppliers and colleagues to notify any other parties who may be affected and not yet know it, and take “any remaining necessary steps” to address the incident.

It said it has also taken further steps to better ensure the integrity, safety and security of its IT infrastructure to “underpin its ongoing client service commitments”.

The organisation’s underlying trading performance remains in line with expectations despite the impact of the cyber attack, with group revenues up by just under 5% year on year (YoY) for the first four months of the year, and sales performance up 16%.