Threat reportRansomwareTL-2026-3795
Capita 2023 Ransomware Incident - Record £14M ICO Fine and Control Failures (Black Basta)
Capita 2023 Ransomware Incident (TL-2026-3795), also tracked as Capita ransomware incident, is a high-severity ransomware operation, first published 2026-10-17. It is attributed to Black Basta with medium confidence, affects Capita Capita plc and Capita Pension Solutions Ltd corporate, maps to 7 MITRE ATT&CK techniques (T1018, T1059.001, T1059.007), and is covered by 9 detection rules and 10 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 1Black Basta
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3795
- Threat ID
- TL-2026-3795
- Also known as
- Capita ransomware incident, Capita 2023 data breach
- Severity
- HIGH
- Status
- RESOLVED
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Black Basta
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- business-process-outsourcing, pensions, government administration, finance
- Target regions
- united kingdom
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Capita 2023 Ransomware Incident
Malware and tooling: Black Basta - S1070, Cobalt Strike, QakBot, SystemBC - S9001, BloodHound - S0521, Cobalt Strike, Rclone - S1040
How Capita 2023 Ransomware Incident works
The UK ICO fined Capita £14M (Capita plc £8M, Capita Pension Solutions Ltd £6M; reduced from a proposed £45M) over the March 2023 ransomware attack that affected 6.6M people. A malicious JavaScript file downloaded on 22 March 2023 raised a high-priority alert within 10 minutes, but the device was not quarantined for 58 hours; attackers escalated to administrator access, exfiltrated nearly 1 TB and deployed ransomware on 31 March. Secondary reporting attributes the attack to Black Basta.
On 22 March 2023 an employee device at Capita downloaded a malicious file, reported by secondary analysis as a JavaScript file named jdmb.js. Capita's endpoint tooling raised a high-priority (P2) alert within 10 minutes, but the target to quarantine the device was one hour and the actual quarantine took 58 hours. During that window the intruder obtained administrator permissions and moved laterally across the network. The ICO found there was no tiering model for administrative accounts, despite the privilege-escalation weakness having been flagged on at least three earlier occasions.
The ICO states that nearly 1 TB of data was exfiltrated on 29-30 March 2023 and that ransomware was deployed on 31 March 2023, after which all user passwords were reset. Affected data included pension records, staff records and customer details, including criminal record information, financial data and special category data. 6.6 million individuals were affected, across 325 of the 600 pension scheme clients served by Capita Pension Solutions. Press coverage also reports that names, addresses, dates of birth and card details were among the stolen data.
Attribution to Black Basta comes from secondary reporting, not the ICO notice. The Record and Infosecurity Magazine report that Black Basta claimed responsibility and posted stolen sample documents on its leak site, which were later removed. A BushiDoToken analysis reports that leaked February 2025 Black Basta internal chat logs contain post-compromise reconnaissance commands tied to Capita. The same analysis lists the following tooling: Qakbot for browser credential harvesting, Cobalt Strike for command and control, BloodHound for Active Directory reconnaissance, Rclone and SystemBC in the exfiltration chain, use of a CAPITA\backupadmin service account about 4.5 hours after initial compromise, compromise of at least 8 domains, and ransomware on 1,057+ hosts. These details are single-source and were not confirmed by the ICO.
The ICO also identified these control failures: an understaffed SOC (a single analyst per shift), misconfigured EDR alert escalation, penetration testing only at commissioning rather than on an ongoing basis, and risk assessment findings siloed within business units. The £45M provisional penalty was reduced by about 69% to £14M through a voluntary settlement in which Capita admitted liability, taking into account post-incident improvements, support for affected individuals and engagement with the NCSC and other regulators. Capita offered 12 months of Experian credit monitoring, which more than 260,000 people activated, and at least 93 complaints were received. No ransom payment has been confirmed. The DoublePulsar source cited by the hunt could not be fetched (HTTP 403) and was not used for any fact here.
MITRE ATT&CK techniques used in TL-2026-3795
Discovery
T1018 Remote System Discovery; T1087.002 Domain Account
Execution
T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File
Privilege Escalation
Credential Access
Affected products and versions in Capita 2023 Ransomware Incident
- Capita — Capita plc and Capita Pension Solutions Ltd corporate environment
Vulnerable versions: March 2023 environment
Remediation for Capita 2023 Ransomware Incident
Immediate actions
- Contain and quarantine endpoints within the target time (Capita's target was 1 hour) when high-priority EDR alerts fire
- Hunt for jdmb.js-style malicious JavaScript downloads and for Cobalt Strike, SystemBC, Qakbot and Rclone artifacts
- Audit and rotate credentials for service and backup administrator accounts such as backupadmin
Workarounds
- Restrict script host execution (wscript/cscript) for downloaded .js files
- Segment domains and restrict lateral movement with admin credentials
Longer-term hardening
- Implement an administrative account tiering model to separate privileged credentials
- Staff the SOC for 24x7 coverage with documented alert escalation and tested EDR alert configuration
- Run ongoing penetration testing and share findings and risk assessments organization-wide
- Track and remediate flagged vulnerabilities to closure with accountable owners
Timeline of Capita 2023 Ransomware Incident
- Per secondary analysis, operators access the CAPITA\backupadmin service account about 4.5 hours after initial compromise.
- Employee device downloads a malicious file (reported as JavaScript file jdmb.js); a high-priority alert is raised within 10 minutes.
- The initially compromised device is quarantined after a 58-hour delay against a 1-hour target; per secondary analysis the attacker had already established persistence.
- Exfiltration of nearly 1 TB of data begins (29-30 March).
- Ransomware deployed in the Capita environment (1,057+ hosts per secondary analysis); user passwords subsequently reset.
- Capita publicly confirms a cyber incident, initially stating there was no evidence of customer, supplier or colleague data being compromised.
- Black Basta lists Capita on its extortion site with sample stolen data; the listing is later removed (some reports give 17 April).
- Capita confirms that data was exfiltrated and advises customers to assume their data was stolen.
- Leaked Black Basta internal chat logs (February 2025) contain post-compromise reconnaissance commands linked by analysts to the Capita intrusion.
- ICO announces a £14M fine (Capita plc £8M, Capita Pension Solutions Ltd £6M), down from a £45M provisional penalty, after a voluntary settlement.
Sources cited for Capita 2023 Ransomware Incident
- ICO: Capita fined £14m for data breach affecting over 6m people
- TechRadar: Capita handed huge £14m fine over security failings which lead to data breach
- The Record: Capita record fine, UK ICO, ransomware attack
- Infosecurity Magazine: Capita Fined £14m After 2023 Breach that Hit 6.6 Million People
- BushiDoToken: Lessons from the BlackBasta Ransomware Attack on Capita
- DoublePulsar: What organisations can learn from the record-breaking fine over Capita's ransomware incident (not fetched, HTTP 403)
- BleepingComputer: Capita confirms hackers stole data in recent cyberattack
- Security Affairs: Capita warns customers to assume that their data was stolen
Detection coverage for TL-2026-3795
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3795 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.