# Capita 2023 Ransomware Incident - Record £14M ICO Fine and Control Failures (Black Basta)

> The UK ICO fined Capita £14M (Capita plc £8M, Capita Pension Solutions Ltd £6M; reduced from a proposed £45M) over the March 2023 ransomware attack that affected 6.6M people. A malicious JavaScript file downloaded on 22 March 2023 raised a high-priority alert within 10 minutes, but the device was not quarantined for 58 hours; attackers escalated to administrator access, exfiltrated nearly 1 TB and deployed ransomware on 31 March. Secondary reporting attributes the attack to Black Basta.

- **Published:** 2026-10-17T01:54:12Z
- **Last reviewed:** 2026-10-17T01:54:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3795
- **ID:** TL-2026-3795
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** RESOLVED
- **Actor:** Black Basta
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 22 March 2023 an employee device at Capita downloaded a malicious file, reported by secondary analysis as a JavaScript file named jdmb.js. Capita's endpoint tooling raised a high-priority (P2) alert within 10 minutes, but the target to quarantine the device was one hour and the actual quarantine took 58 hours. During that window the intruder obtained administrator permissions and moved laterally across the network. The ICO found there was no tiering model for administrative accounts, despite the privilege-escalation weakness having been flagged on at least three earlier occasions.

The ICO states that nearly 1 TB of data was exfiltrated on 29-30 March 2023 and that ransomware was deployed on 31 March 2023, after which all user passwords were reset. Affected data included pension records, staff records and customer details, including criminal record information, financial data and special category data. 6.6 million individuals were affected, across 325 of the 600 pension scheme clients served by Capita Pension Solutions. Press coverage also reports that names, addresses, dates of birth and card details were among the stolen data.

Attribution to Black Basta comes from secondary reporting, not the ICO notice. The Record and Infosecurity Magazine report that Black Basta claimed responsibility and posted stolen sample documents on its leak site, which were later removed. A BushiDoToken analysis reports that leaked February 2025 Black Basta internal chat logs contain post-compromise reconnaissance commands tied to Capita. The same analysis lists the following tooling: Qakbot for browser credential harvesting, Cobalt Strike for command and control, BloodHound for Active Directory reconnaissance, Rclone and SystemBC in the exfiltration chain, use of a CAPITA\backupadmin service account about 4.5 hours after initial compromise, compromise of at least 8 domains, and ransomware on 1,057+ hosts. These details are single-source and were not confirmed by the ICO.

The ICO also identified these control failures: an understaffed SOC (a single analyst per shift), misconfigured EDR alert escalation, penetration testing only at commissioning rather than on an ongoing basis, and risk assessment findings siloed within business units. The £45M provisional penalty was reduced by about 69% to £14M through a voluntary settlement in which Capita admitted liability, taking into account post-incident improvements, support for affected individuals and engagement with the NCSC and other regulators. Capita offered 12 months of Experian credit monitoring, which more than 260,000 people activated, and at least 93 complaints were received. No ransom payment has been confirmed. The DoublePulsar source cited by the hunt could not be fetched (HTTP 403) and was not used for any fact here.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1078.002 Domain Accounts
- T1555.003 Credentials from Web Browsers
- T1087.002 Domain Account
- T1018 Remote System Discovery

## Sources

- [ICO: Capita fined £14m for data breach affecting over 6m people](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/10/capita-fined-14m-for-data-breach-affecting-over-6m-people)
- [TechRadar: Capita handed huge £14m fine over security failings which lead to data breach](https://www.techradar.com/pro/security/huge-gbp14m-fine-handed-to-capita-for-security-failings-leading-to-data-breach)
- [The Record: Capita record fine, UK ICO, ransomware attack](https://therecord.media/capita-record-fine-uk-ico-ransomware-attack)
- [Infosecurity Magazine: Capita Fined £14m After 2023 Breach that Hit 6.6 Million People](https://www.infosecurity-magazine.com/news/capita-fined-14m-2023-breach-66/)
- [BushiDoToken: Lessons from the BlackBasta Ransomware Attack on Capita](https://blog.bushidotoken.net/2025/10/lessons-from-blackbasta-ransomware.html)
- [DoublePulsar: What organisations can learn from the record-breaking fine over Capita's ransomware incident (not fetched, HTTP 403)](https://doublepulsar.com/what-organisations-can-learn-from-the-record-breaking-fine-over-capitas-ransomware-incident-6afbdfcdd35b)
- [BleepingComputer: Capita confirms hackers stole data in recent cyberattack](https://www.bleepingcomputer.com/news/security/capita-confirms-hackers-stole-data-in-recent-cyberattack/)
- [Security Affairs: Capita warns customers to assume that their data was stolen](https://securityaffairs.com/146200/data-breach/capita-warns-customers.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3795