FCA urges Capita clients to investigate data breach for signs of compromise

UK financial regulatory body the Financial Conduct Authority (FCA) has urged clients of Capita to investigate their data and IT systems following a ransomware attack in late March. The Guardian has reported that the FCA reached out to Capita’s clients including FTSE 100 insurance firms Aviva and Phoenix Group alongside several pension firms including Pension Insurance Group and Rothsay to ensure they are sufficiently reviewing and responding to potential data breaches.

Cyber actors attacked Capita for over a week, gaining unauthorised access to data and restricting customer-facing services. The public sector outsourcer is a major government supplier with £6.5 billion of contracts involving the congestion zone system in London, as well as collecting the BBC licence fees and critical NHS operations.

Capita confirms unauthorised data access, exfiltration

Capita issued a public notice on March 31 that it was experiencing a cyber incident primarily impacting access to internal applications. “This caused disruption to some services provided to individual clients, though the majority of our client services remained in operation,” it said. It originally denied speculation that the incident was the result of an attack, but later confirmed that it had suffered unauthorised access to a server estate with evidence of limited data exfiltration. Stolen data is reported to include client information, information on job applicants, payment details of Capita Business Services’ Capita Nuclear unit, and internal floor plans.

FCA advises regulated firms to assess extent of any data compromise

The FCA has continued to engage with Capita since their cyber incident was reported to understand the extent of any data compromise and impact on firms they provide outsource services to including their underlying customers, it said in the Guardian story. It has “written to FCA regulated firms that are clients of Capita to ensure they are fully engaged in understanding the extent of any data compromise.”

Over the weekend, the Pensions Regulator confirmed it had also written to the hundreds of pension funds that employ Capita to help administer their payment systems, urging them to “determine whether there is a risk to their scheme’s data.”