Kevin BeaumontMar 31, 2023
The Guardian (who are themselves working out of a pub still due to a ransomware attack in December 2022) are reporting #Capita (a major IT supplier) have a "IT incident", staff have been told to not use VPN, and they are working with pen and paper since this morning. Thread follows. https://www.theguardian.com/business/2023/mar/31/capita-it-systems-fail-cyber-attack-nhs-fears?CMP=share_btn_tw
Failed IT systems at Capita fuel fears of cyber-attack on crucial NHS provider

Staff unable to access computers and local authority phone lines knocked out as outsourcing giant investigates possible data breach

The Guardian
Show threadKevin BeaumontMar 31, 2023

I had forgot how big Capita are. It's like 492304932 different business units. Shodan Safari is like looking into the sun.

It looks like some of the plc centrally use Okta for authentication.. I hope they enabled Number Verification.

Show threadKevin BeaumontMar 31, 2023
The Times just filed a piece saying the #Capita outage is ongoing and hitting "every division" (only one source, not sure I buy it), with staff getting verbal 'round robin' updates. https://www.thetimes.co.uk/article/2a6270b8-cfbd-11ed-9a00-73fd2b90e22e?shareToken=1df09835bc32a38e9b8ae2b0e7556097
Capita hit by IT breakdown amid fears of cyberattack

Capita, one of the UK’s biggest outsourcers, is investigating an incident with its IT systems which has prevented staff from logging in.Employees at the company, which handles important government contracts including for the NHS, have been denied access since before 7am.They have been told in round robin phone messages “not to attempt access via VPN or submit password recovery requests”.

The Times
Show threadKevin BeaumontMar 31, 2023

The Times reporter is being verbally briefed as #Capita still don't have email (almost 10 hours in).

They're told: 'There appears to be no risk to personal data processed by the business. The outage seems to be is hitting Office365 programmes including Outlook, Excel and Teams rather than client systems...'

Show threadKevin BeaumontMar 31, 2023

Financial Times have a new article up about #Capita, saying two people familiar with the matter say cyber incident cannot be ruled out.

Curiously all the media articles about it this evening talk about the IT incident in the past tense - but it is still ongoing, it hasn't been resolved.
https://www.ft.com/content/00f9591f-e07a-4339-ba3e-413818602515

Capita hit by IT failure that left staff unable to access services

News, analysis and comment from the Financial Times, the worldʼs leading global business publication

Financial Times
Show threadKevin BeaumontApr 1, 2023
#Capita are still working to restore service.
Show threadKevin BeaumontApr 1, 2023

Verbal update from #Capita - they’re still restoring internal service, “there is no evidence that any data has been compromised."

They won’t discuss what is happening.

Show threadKevin BeaumontApr 2, 2023
#Capita has been in contact with people at the NCSC and NCA. Interesting an IT supplier would rather talk about a 3 day ongoing IT incident than mention the cyber word.
Show threadKevin BeaumontApr 2, 2023
Latest statement from #Capita - 3 days in they have restored their Office 365 access, and are now trying to restore their customer’s services. “Working in collaboration with our specialist technical partners, we have restored Capita colleague access to Microsoft Office 365 and we are making good progress restoring remaining client services in a secure and controlled manner.”
Show threadKevin BeaumontApr 2, 2023

The Times have a report up saying #Capita NHS services staff are working using WhatsApp and Google Drive, rather than approved Microsoft tooling.

Massively concerned by lack of transparency, going to start digging into this tomorrow with officials. https://www.thetimes.co.uk/article/capita-dogged-by-it-problem-for-three-days-wthl2zp5v

Capita dogged by IT problem for three days

An IT meltdown at Capita continued over the weekend, fuelling speculation of a cyberattack at a company that handles key public service contracts. Staff, incl

The Times
Show threadKevin BeaumontApr 3, 2023
#Capita finally admit they have a cybersecurity incident. No details about what is happening, it’s a regulatory notification. They had been privately briefing customers it wasn’t security related. https://www.londonstockexchange.com/news-article/CPI/statement-re-cyber-incident/15901425
London Stock Exchange | London Stock Exchange

null

Show threadKevin BeaumontApr 3, 2023
I am told various UK regulatory authorities are beginning to look into what has happened at #Capita as there is varying degrees of concern about different elements, e.g. disclosure to customers and ongoing data access.
Show thread🖖
@GossiTheDog hashtag: crapita
Apr 3, 2023 at 5:40pmWeb