Capita: a 10-minute alert, a 58-hour silence, and an account literally named "backupadmin"
The intrusion detection worked. Capita's system flagged the malicious file as a high-priority threat within ten minutes of it landing. Nobody actually responded for 58 hours, because the company had exactly one SOC analyst on duty, company-wide, to look at it. By the time anyone did, the attacker was already inside using a domain-admin account named, with no apparent irony, "backupadmin."
Background
Capita is one of the UK's largest outsourced business-process providers — the kind of company most people have never heard of but whose systems quietly administer pensions, payroll and HR records for hundreds of other organisations. Capita Pension Solutions alone processed data on behalf of more than 600 separate pension schemes. That structure is exactly why a March 2023 ransomware attack on Capita's own infrastructure became a breach notice for 325 of those schemes and 6.6 million people who had never signed a contract with Capita directly, had never heard of the company, and had no way to have prevented any of it themselves.
Ten minutes to detect it. Fifty-eight hours to look at it.
What actually happened
At 07:52 on March 22, 2023, a malicious file reached an employee's device at Capita. Whatever ran next was bad enough that Capita's own endpoint detection flagged it as a P2, High-priority alert within ten minutes — at 08:00. That's the system working as designed. What happened next is the part the UK's Information Commissioner's Office (ICO) would later spend an entire investigation on: nobody actually looked at that alert for 58 hours. Capita had exactly one security operations centre analyst on duty across the whole company at the time.
While that alert sat unactioned, the attacker moved. Around 12:13 the same day — roughly four hours after the first alert, and still more than two days before anyone would respond to it — they logged in using a service account called "backupadmin." That account held full, unrestricted domain administrator privileges, had no device restrictions limiting where it could be used from, and was not being monitored. From there the attacker deployed Qakbot and Cobalt Strike, two well-known intrusion tools, and used the same account to pivot into eight further Capita domains.
Over March 29 and 30, roughly 1 terabyte of data was exfiltrated. Ransomware — widely attributed to the Black Basta group, though that attribution is reported rather than formally confirmed by Capita or UK authorities — was deployed on March 31. Whether Capita ultimately paid a ransom has never been confirmed either way; the group's listing for Capita later disappeared from its leak site, which is sometimes a signal of payment but is not proof of one.
The eventual scope: 6.6 million people affected, more than 5.7 million of them through Capita Pension Solutions alone, spanning 325 separate pension schemes that had outsourced their administration to Capita and had no direct relationship with the attacker, the vulnerability, or the decision that left it unpatched. Data posted to the leak site reportedly included bank account details, passport photos, driving licences, employment-screening and job-applicant information, and building floor plans.
The ICO's investigation surfaced one more detail that turned this from a bad breach into a genuinely damning one: the vulnerability the attacker is believed to have exploited had already been flagged by three separate penetration tests dating back to August 2022. Capita's own internal security policy required pen-test findings to be reported directly to the CISO. The finding had been made. It had not been fixed.
Root cause
- A high-priority security alert fired within ten minutes of a malicious file reaching an employee device, at 08:00 on March 22, 2023, but was not actioned for 58 hours because Capita had only one SOC analyst on duty company-wide.
- The attacker gained access using a service account, "backupadmin," that held unrestricted domain administrator privileges, had no device-based access restrictions, and was not monitored — a direct violation of least-privilege and privileged-access-management principles.
- The vulnerability believed to have enabled the intrusion had been identified by three separate penetration tests since August 2022 and was never remediated, despite a Capita policy requiring pen-test findings to be escalated directly to the CISO.
- Qakbot and Cobalt Strike were deployed using the compromised backupadmin account, which was then used to pivot laterally into eight further Capita domains; roughly 1TB of data was exfiltrated on March 29–30, and ransomware was deployed March 31.
- How the malicious file first reached the employee's device is disputed across reporting: one outlet's coverage implies phishing, while a separate account citing Microsoft's own investigation found no evidence of phishing and suggests a drive-by download instead. This case study presents both as unresolved rather than picking one.
- Whether Capita paid a ransom has never been confirmed by the company either way. The attacker's listing for Capita later vanished from its leak site, which is sometimes read as a signal of payment, but that is circumstantial, not confirmation.
- Black Basta's involvement is widely reported but described in most sourcing as "believed" or "claimed" rather than a fact formally confirmed by Capita or a UK authority.
Timeline
Detection
Capita's own endpoint detection flagged the malicious file as a P2, High-priority alert within ten minutes of it landing, at 08:00 on March 22, 2023 — detection itself worked exactly as designed.
Ten minutes from the malicious file landing (07:52) to a high-priority alert firing (08:00). The failure was not detection speed; it was response speed — the alert sat unactioned for 58 hours afterward.
- The high-priority alert that fired at 08:00 on March 22 was not actioned for 58 hours, because Capita had exactly one SOC analyst on duty company-wide at the time — a staffing gap, not a missed technical signal.
- The "backupadmin" service account used to gain unrestricted domain-admin access around 12:13 the same day had no device restrictions and was not being monitored at all, so its use produced no separate alert of its own.
- The vulnerability believed to have enabled the intrusion had already been flagged by three separate penetration tests dating back to August 2022, under a policy requiring direct escalation to the CISO — a known finding that was never remediated.
What to monitor for in your own environment
Login or use of a service account holding unrestricted domain-administrator privileges, especially from an unfamiliar device
Privileged-account and Active Directory usage monitoring, tiered separately from standard-account alertsA high-priority security alert left unactioned past a defined response-time threshold
SOC alert-queue aging and escalation monitoring, independent of whether staff happen to be availableAn unremediated penetration-test finding still open past its required escalation or fix deadline
Penetration-test finding tracking and remediation-SLA reportingContainment, eradication & recovery
Containment
Mar 22–31, 2023- Public sources reviewed for this case study don't detail the specific moment Capita actually began containing the intrusion once it was eventually noticed, beyond the confirmed 58-hour gap before any response began.
- Ransomware was deployed March 31, 2023, roughly a week after the initial compromise — by which point any containment that did occur had not stopped the intrusion from reaching that stage.
Eradication
Not itemized in public reporting- The ICO's own investigation and findings focus on root cause (the backupadmin account, the unremediated pen-test findings, the staffing gap) rather than a step-by-step account of Capita's technical remediation. This case study does not assume specific eradication steps beyond what's confirmed.
- The ICO credited post-incident security improvements Capita made as a mitigating factor in setting the final penalty, without detailing each improvement individually.
Recovery
2023 – Oct 2025- Notified 325 pension schemes and 6.6 million affected people, offering 12 months of free credit monitoring — though the notification process drew documented criticism for being slow and inconsistent in the weeks immediately following the attack.
- Admitted liability to the ICO and did not appeal; the final fine, announced October 14–15, 2025, was reduced from a proposed £45 million to £14 million, split £8 million against Capita plc and £6 million against Capita Pension Solutions, citing cooperation, remediation and support for affected individuals as mitigating factors.
- A separate civil litigation track, including a February 2026 High Court ruling allowing roughly 4,000 individual compensation claims to proceed, remains open.
Security control analysis
The ICO found no tiering model separating privileged accounts from standard ones, no just-in-time or least-privilege access, and the "backupadmin" account specifically held unrestricted domain-admin rights with no device restriction and no monitoring at all.
Detection worked — the alert fired within ten minutes. One analyst on duty company-wide is not a staffing level that can act on a high-priority alert in any meaningful window, and the 58-hour gap is the direct, measurable consequence.
The exploited weakness had been flagged three separate times since August 2022, with a policy explicitly requiring escalation to the CISO. A finding reported three times and fixed zero times is a process failure, not a one-off miss.
The compromised account was able to reach eight further domains. Whatever segmentation existed didn't meaningfully constrain a single compromised domain-admin credential.
Capita has never confirmed paying or not paying. The attacker's leak-site listing for Capita later disappeared — suggestive, not conclusive — and this case study treats the question as genuinely open.
325 pension schemes and their members were eventually notified and offered 12 months of free credit monitoring, but the process drew documented criticism for being slow and inconsistent in the weeks immediately following the attack.
Controls that would have prevented or limited this
Would have denied the attacker the unrestricted, unmonitored domain-admin access the backupadmin account provided outright.
Would have closed the 58-hour gap between the alert firing and anyone looking at it — the single largest controllable factor in how far this intrusion was allowed to progress.
Would have fixed the specific vulnerability flagged three separate times since August 2022 before it could be exploited.
Would have limited the attacker's pivot from one compromised account into the eight further domains actually reached.
Blast radius
What was exposed
- Bank account details, passport photos and driving licences for a subset of the 6.6 million people affected
- Employment-screening and job-applicant data, including teacher applicants
- Building floor plans and other internal operational records
What remains unconfirmed
- Whether National Insurance numbers were among the exposed data — not confirmed in available reporting, and this case study does not assert it
- Whether a ransom was ultimately paid
- The final outcome of ongoing civil litigation brought by affected individuals
The fine dropped by two-thirds before it was finalised
What they got right
Capita admitted liability to the ICO rather than contesting the investigation's findings, and did not appeal the final fine — a posture that, per the ICO's own stated reasoning, directly contributed to the fine being reduced from £45 million to £14 million.
Affected individuals were offered 12 months of free credit monitoring, and the ICO specifically credited post-incident security improvements Capita made as a mitigating factor in setting the final penalty.
Capita cooperated with the ICO's investigation in a way that produced an unusually detailed public account of exactly what went wrong — the 58-hour gap and the backupadmin account wouldn't be public, specific, and checkable facts otherwise, and that level of disclosure is itself useful to every other organisation reading this case study.
Why this keeps happening
An unmanaged, overprivileged service account is one of the single most common findings across major breaches generally, not a Capita-specific failure — "backupadmin" is a strikingly honest name for exactly the kind of account that tends to get created for a one-off task, granted broad rights to make that task easy, and then never revisited again.
Detection tooling and response capacity are two different investments, and organisations routinely fund the first while underfunding the second. A ten-minute alert and a 58-hour response gap sitting in the same incident is the clearest possible illustration that buying the alert isn't the same as being able to act on it.
A penetration test's value is entirely dependent on what happens after the report is delivered. Three findings of the same unremediated vulnerability, with a policy requiring CISO escalation that evidently didn't translate into a fix, points to a process gap between "knowing" and "doing" that shows up across the industry far more often than most organisations would like to admit.
Outsourced administrators concentrate risk for organisations that never chose to be exposed to it. The 325 pension schemes and 6.6 million people affected here had a relationship with their own pension scheme, not with Capita — and had no visibility into, or control over, the security decisions that actually determined their exposure.
Lessons for your own environment
- A detection alert nobody is staffed to act on isn't a control
Capita's tooling flagged the threat within ten minutes. The 58-hour gap before anyone responded, caused by having one SOC analyst on duty company-wide, is the actual failure — and it's a staffing decision, not a technology one.
- Name your privileged accounts for what they can do, and review them accordingly
"backupadmin" held full domain-admin rights with no restrictions and no monitoring. Any account with that level of access needs tiering, least-privilege scoping and active monitoring — regardless of how routine or forgettable its original purpose was.
- A penetration-test finding that isn't remediated is worse than not testing at all
The exploited vulnerability was flagged three times over seven months, with a policy requiring it reach the CISO. A known, repeatedly-documented gap left open is a harder failure to explain than an unknown one.
- Outsourcing administration doesn't outsource your exposure
325 pension schemes' members were affected by a breach at a vendor they likely never knew by name. If your organisation outsources sensitive data administration, your exposure is tied to that vendor's security posture, not just your own.
- Cooperation and admitted liability can materially change a regulatory outcome
Capita's fine dropped from a proposed £45M to a final £14M, with the ICO explicitly citing cooperation, remediation and support for affected people as mitigating factors. How an organisation responds after a breach is itself a decision regulators weigh.
- Regulatory admission and civil liability are not the same claim
Capita admitted liability to the ICO but is contesting liability in the civil claims brought by affected individuals. That's a legitimate, if uncomfortable, distinction — but it's one every stakeholder reading about "admitted liability" should understand isn't the whole picture.
CISO & board lessons
- Put a number on your actual detection-to-response capacity, not just your detection coverage. A board approving a SIEM or EDR purchase should ask, in the same conversation, how many people are staffed to act on what it flags — and at what hour, on what day, with what backup coverage.
- Treat every penetration-test finding as having an enforced remediation deadline, not a routing destination. A policy that gets a finding to the CISO's inbox three times without it being fixed is a process failure a board should be auditing directly, not assuming works because the policy exists on paper.
- Service-account privilege review belongs on a board-level audit cadence, not an ad hoc one. An account named for a narrow, forgettable task holding unrestricted domain-admin rights is exactly the kind of gap that survives for years specifically because nobody is required to check it.
- Understand, and be ready to explain to stakeholders, the difference between admitting liability to a regulator and defending liability in civil court. These can be simultaneously true, and a board caught flat-footed explaining that distinction after the fact looks worse than one that anticipated the question.
Action plan
First 24 hours
- Confirm, specifically, what your organisation's actual detection-to-response time looks like for a high-priority alert fired outside business hours or on a short-staffed shift — not the documented SLA, the real one.
- Inventory every service account with domain-administrator or equivalent broad privileges, and flag any without device restrictions or active monitoring as an immediate review item.
- Pull the most recent penetration-test report and confirm every finding has a named owner and a remediation date, not just a routing record showing it was sent somewhere.
First 7 days
- Implement or verify a tiered Active Directory / privileged-access model separating standard accounts from privileged ones, with least-privilege and just-in-time elevation for anything with domain-admin-equivalent rights.
- Review SOC staffing coverage against actual alert volume and severity distribution, including nights, weekends and any single-point-of-failure shift coverage.
- If your organisation administers data on behalf of other organisations (as a vendor, outsourcer or platform), confirm your downstream notification process could actually scale to hundreds of client organisations on short notice.
First 30 days
- Establish a tracked, auditable remediation SLA for every penetration-test and vulnerability-assessment finding, with escalation that doesn't stop at a single inbox.
- Build or rehearse an incident-response plan specifically for the scenario where detection worked but response capacity didn't keep pace — including a rapid staffing-surge plan for exactly that gap.
- Document your organisation's posture on ransom-payment decisions and privileged-account governance in terms a regulator could later assess as mitigating or aggravating factors, the way the ICO explicitly weighed both in Capita's case.
Could this happen in your organization?
- If a high-priority security alert fired right now, outside business hours, how long would it realistically take before a human being looked at it?
- Can you name every service account in your environment with domain-administrator or equivalent rights, and confirm each one is actively monitored and restricted to specific devices?
- Do your penetration-test findings have an enforced remediation deadline and a named owner, or do they end at a report being sent to someone?
- If your organisation administers or processes data for other organisations, could your breach-notification process actually scale to hundreds of downstream clients within a reasonable window?
- Has your SOC staffing level ever been stress-tested against your actual alert volume, including worst-case timing (nights, weekends, holidays)?
- Would your organisation's posture on cooperating with a regulator versus contesting civil claims be a deliberate, board-understood strategy, or a decision made reactively under pressure?
If this happened to you: what to ask, and what to say
Knowing the lesson isn’t the same as knowing what to do with it Monday morning. A security lead, a CISO, and a customer-facing team each need something different from this incident.
- "If our highest-priority alert fired at 2am on a Saturday, how long before someone actually looked at it?"Capita's alert fired within ten minutes and sat unactioned for 58 hours because of staffing, not technology. Get the honest answer, not the SLA document's answer.
- "Can we name every account in our environment with unrestricted domain-admin rights, and who's watching them?""backupadmin" was exactly this kind of account — broad, old, unmonitored. Ask for the actual list, not an assurance that privileged accounts are managed.
- "Do our pen-test findings have a deadline and an owner, or just a destination?"This vulnerability was flagged three times over seven months and fixed zero times, despite a policy requiring CISO escalation. A routing policy isn't a remediation policy.
- "If we're a vendor or outsourcer, could our notification process handle hundreds of downstream client organisations at once?"325 pension schemes had to be notified individually. Walk through whether your own process would scale, or buckle, under that volume.
- State what actually failed, precisely.A board needs the specific gap, not a general description of "a cyberattack.""Our detection tooling worked — it flagged the threat within ten minutes. The failure was that we didn't have enough staff on duty to respond to it for over two days, and the account the attacker used should never have had the access it did."
- Explain the fine reduction honestly.A dropped fine sounds like good news; explain what actually earned it."The regulator's proposed fine was reduced by about two-thirds specifically because we cooperated fully, made real security improvements, and supported affected individuals. That reduction was earned by the response, not avoided by a loophole."
- Address the liability-admission-versus-civil-defense distinction directly.Don't let this surface as a contradiction someone else points out."We admitted liability to the regulator because the regulator's findings were accurate. We are separately defending some of the civil claims, which involve different legal questions about individual damages — these are not contradictory positions."
- Commit to specific, auditable fixes.Name the actual changes, not a general security-investment promise."We've implemented privileged-access tiering, increased SOC staffing coverage, and put an enforced remediation deadline on every penetration-test finding going forward. We can walk the board through each of these in the next review."
- If you're a downstream organisation whose administrator was breached, tell your own members plainly what happened.Don't let your members learn the vendor's name from a news story before they hear it from you."A company we use to administer part of our pension scheme, Capita, experienced a cyberattack that exposed some member data. Here is exactly what we know was affected for our scheme specifically."
- Be specific about what data was and wasn't involved for your own members.A generic "your data may have been affected" notice is the least useful version of this message."Based on what we've been told, the data categories potentially affected for our members include [specific list]. We do not have confirmation that [specific category] was involved."
- Explain what protective step is actually available.Point to something concrete the recipient can do."Capita is offering 12 months of free credit monitoring to affected individuals. Here is exactly how to enroll, and what it covers."
- Acknowledge that you, too, are waiting on answers from a vendor you don't control.Honesty about the limits of your own visibility builds more trust than false reassurance."As your scheme administrator's own vendor, we are continuing to receive updates from Capita and will share anything new as it's confirmed. We don't control their investigation, but we are staying on top of it on your behalf."
References & confidence
- ConfirmedICO — Capita fined £14m for data breach affecting over 6m people — The regulator's own published findings — primary source for the 10-minute/58-hour timeline, the backupadmin account, and the three ignored pen-test findings.
- ConfirmedThe Register — Capita fined £14M after 58-hour delay exposed 6.6M records — Detailed technical timeline; also the source noting Microsoft's investigation found no phishing evidence and suspected a drive-by download, disputing other outlets' phishing framing.
- ConfirmedGRC Report — Capita Fined £14 Million
- ReportedInfosecurity Magazine — Capita Fined £14m — States phishing as the entry vector; this is disputed by The Register's reporting on Microsoft's own findings, so this case study presents both rather than picking one.
- ReportedBushidotoken — Lessons from the Black Basta Ransomware Attack on Capita — Detailed independent technical analysis; Black Basta attribution itself is reported/believed, not formally confirmed by Capita or a UK authority.
- ConfirmedLeigh Day — Capita Data Breach Claim — The group civil claim exists and is active; its outcome is Unknown — not yet resolved.
- ConfirmedRopes & Gray — Spurgeon & Ors v Capita, High Court ruling — February 2026 ruling refusing to strike out roughly 4,000 individual compensation claims. This civil litigation track remains open and separate from the finished ICO action.
- ReportedITPro — Capita cyberattack could cost firm up to $25 million in fees — Cost estimate for recovery and remediation, separate from and not to be confused with the ICO fine.
- UnknownWhether Capita paid a ransom — Never confirmed by Capita either way; the attacker's leak-site listing later disappearing is circumstantial, not confirmation.