Capita cyberattack disrupted Microsoft 365 access and exposed client data

Capita, the London based outsourcing group whose UK clients included the NHS, the military, the Department for Work and Pensions and dozens of local councils, disclosed on April 3, 2023 that it had suffered a cyber incident. The company said the disruption began early on Friday, March 31 and primarily affected access to internal Microsoft 365 applications, along with some services provided to individual clients.

Capita said at first that there was no evidence customer, supplier or colleague data had been compromised. That position did not hold. On April 20 the company acknowledged evidence of limited data exfiltration from around four percent of its server estate, after the Black Basta ransomware group listed Capita on its extortion site and published samples reported to include bank account details, addresses and passport scans.

Investigators established that the intrusion began on March 22, 2023, when an employee unwittingly downloaded malware. A security alert fired within ten minutes, but the affected device was not quarantined for 58 hours, giving the attackers time to escalate privileges and move across the network.

The consequences fell heavily on pension administration. The UK Information Commissioner's Office later concluded that personal data relating to about 6.6 million people had been compromised, that the stolen material included pension records, staff files, criminal records and financial information, and that more than half of Capita's roughly 600 pension clients were caught up in the incident. The regulator fined Capita £14 million in October 2025, reduced from an intended £45 million.