Loading story…
Capita said a March ransomware attack attributed to Black Basta compromised its Microsoft 365 environment and led to the theft of personal data from employees, customers, and clients. The outsourcing firm acknowledged that data was exfiltrated from less than 0.1% of its server estate, but the impact spread widely because Capita provides services to many organizations. Reporting indicated that customer data was stolen, and Capita notified affected customers, suppliers, and staff while working with forensic specialists and expanding remediation and security investments.
The breach triggered broad fallout across the UK. About 90 organizations reported personal data breaches to the Information Commissioner’s Office, and regulators contacted more than 300 pension funds to assess possible exposure. The Universities Superannuation Scheme warned that details for roughly 470,000 members may have been compromised, including names, dates of birth, National Insurance numbers, and pension membership numbers. Capita later said the incident would cost £20 million to £25 million, and by its annual results said the cyberattack had contributed to a loss of more than £106 million.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Capita later said the cyberattack contributed to an annual loss of more than £106 million. This marked a further financial escalation beyond the earlier £20 million to £25 million incident-cost estimate.
Capita said the March cyberattack was expected to cost £20 million to £25 million, as recovery and remediation continued. The company also confirmed Black Basta attribution, said less than 0.1% of its server estate was affected, and noted it could not yet estimate any regulatory fine.
Roughly 90 organizations submitted personal data breach reports to the UK Information Commissioner's Office following the Capita incident. The Pensions Regulator also contacted more than 300 pension funds to assess whether member data had been stolen.
The Universities Superannuation Scheme said personal data for about 470,000 members may have been compromised through Capita, which administers its pension services. USS advised members to assume the data was taken and said it would notify affected individuals and employers.
Capita acknowledged that customer, supplier, or colleague data may have been compromised during the March cyberattack. The company said some data had been exfiltrated and began contacting affected parties while continuing forensic investigation and remediation.
Capita experienced a company-wide IT outage on 2023-03-31 that disrupted employee access to Office365 services, including email and Teams, and affected some council phone lines. The incident prompted notification of the National Cyber Security Centre and the Cabinet Office amid concern over Capita's role in supporting critical UK public services.
Capita said the cyberattack began in March 2023. Attackers later identified as Black Basta compromised the company's Microsoft Office 365 environment and accessed data from a small portion of its server estate.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcetheguardian.com
Open sourcebbc.com
Open sourcetheguardian.com
Open sourcethetimes.com
Open sourcecomputerweekly.com
Open sourcetheguardian.com
Open sourcetheguardian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK Information Commissioner's Office (ICO) imposed a record £14 million fine on Capita, the country's largest outsourcing company, following a major cyberattack in 2023 that compromised the personal data of 6.6 million people. The penalty was split between Capita plc (£8 million) and Capita Pension Solutions Limited (£6 million), reflecting the widespread impact across both the parent company and its pension subsidiary. The breach affected 325 out of more than 600 organizations that rely on Capita’s services, exposing sensitive information such as bank and credit card details, biometric data, passport information, login credentials, and even child data. For some individuals, the stolen data included details of criminal records, financial information, and other special category data. The ICO’s investigation found that Capita failed to implement adequate technical and organizational measures to secure personal data, leaving it vulnerable to attack and unable to respond effectively when the breach occurred. The attack began when a malicious JavaScript file was downloaded onto an employee’s device on March 22, 2023, but the compromised device was not quarantined for 58 hours, allowing attackers to access and exfiltrate data. Capita initially claimed there was no evidence of data compromise, but subsequent findings contradicted this, revealing the extent of the breach. The ICO originally considered a much higher fine of £45 million, but reduced the amount after Capita demonstrated improvements in security, provided support to victims, and cooperated with authorities including the National Cyber Security Centre. The breach led to significant anxiety and stress among affected individuals, with some reporting financial losses. Despite the incident, Capita continued to secure substantial government contracts, with 241 contracts worth £6 billion awarded since the breach. The ICO emphasized that no organization is too large to be held accountable for data protection failures and highlighted the importance of proactive cybersecurity measures. The fine represents approximately 12 percent of Capita’s 2024 post-tax profits, underscoring the financial and reputational consequences of inadequate data security. The incident serves as a stark reminder to all organizations of the critical need to safeguard personal data and maintain robust incident response capabilities.
Jun 29, 2026
Rome’s **La Sapienza University** shut down network systems as a precaution after a cyberattack caused widespread disruption and left its website offline; Italian media attributed the incident to a suspected ransomware operation linked to pro-Russian actor **Femwar02**, with reported tradecraft resembling **Bablock/Rorschach**-style fast encryption. Separately, Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT and took down `www.conpet.ro` while leaving **OT/SCADA** and pipeline transport operations unaffected; **Qilin** claimed responsibility, alleging theft of nearly **1TB** of data and posting sample documents (including financial data and passport scans) to support extortion claims. In the U.S., government services contractor **Conduent** faced expanding breach impact from its January 2025 ransomware incident, with notifications indicating exposure potentially reaching **dozens of millions**; reported affected data includes **names, Social Security numbers, and medical/health insurance information**, with at least **15.4M** impacted in Texas and **10.5M** in Oregon per state disclosures. Additional healthcare-sector disclosures included a ransomware-linked intrusion at **Insightin Health** (unauthorized access in September 2025; **Medusa** claimed exfiltration of **378GB**) and a separate compromise at **Clinic Service Corporation** (August 2025 access window), while **Central Ozarks Medical Center** reported a criminal cyberattack affecting **11,818** individuals with exposure of PHI/PII (including SSNs and financial/insurance data). Other items in the set were not incident-specific: an **HHS-OIG** audit describing web application security weaknesses at a large hospital, and general guidance/education pieces on the value of medical records to attackers and **CISA** insider-threat guidance.
Jun 29, 2026
Ingram Micro disclosed that a **July 2025 ransomware attack** resulted in the theft of files from internal repositories and a subsequent data breach affecting **~42,000 people** (reported as **42,521** in filings). The company said an unauthorized party accessed and exfiltrated certain files between **July 2–3, 2025**, and that it detected the incident on **July 3**, after which it took systems offline and began containment and remediation with external cybersecurity experts and law enforcement notification. The compromised data primarily involved **employee and job applicant records**, including names, contact details, dates of birth, and government-issued identification numbers such as **Social Security**, driver’s license, and passport numbers, as well as some **employment-related information** (e.g., work-related evaluations). The incident also caused significant operational disruption, including outages impacting internal systems and customer-facing operations; reporting noted that **SafePay** claimed responsibility and alleged theft of **~3.5 TB** of data, though Ingram Micro has not publicly attributed the intrusion to a specific threat group while confirming ransomware was deployed.
Jun 29, 2026