This thread is almost 1000 days old and getting a resurrection. #Capita have been fined £14m by the ICO over their ransomware incident.

Lots of big details in the fine, including over 1tb of data stolen (as detailed in this Mastodon thread at the time), confirmation of Qakbot and my blog etc.

Their SOC was wildly understaffed. It took attacker 4 hours to get domain admin due to poor security practices. Lots of learnings for large orgs.

If you look at the NCSC UK too, their remit is to help make the UK the safest place to do business..

but if you look at the general output lately, it’s quantum stuff and firewall espionage stuff. They’re good people but it feels too close to GCHQ, and so too far removed from the operational reality on the ground.

Personally I think the UK is going to be one to watch now, as if I was an e-crime threat actor - I’d zero in on the UK.

Orgs have shown they will pay, teens getting in and poor MSPs shows poor security practices, the NCA won’t tell the ICO (data regulator) too around what actually happened, and the government will bail out orgs financially and provide IR help while they recover.

It’s all of the wrong messages being broadcast. Strap in.