A House Of Cards

Uploaded on 2023-06-08 in NEWS-Cybersecurity News, FREE TO VIEW

The 2023 Capita hacks have caused ripples throughout the industry, affecting hundreds of organisations that use the outsourcing giant to administer pension funds. With incidents coming to light in both March and May of this year, the ramifications have left not only Capita customers but thousands of their clients dealing with the repercussions of having their data breached.

As arguably the most high-profile cyber incident we’ve seen this year, affecting a range of providers within financial services and beyond, the events of the past few months create significant concerns for Capita customers and pose serious questions as to how we should be protecting the valuable data that firms hold. Why did these incidents occur in the first place? More importantly, how can they be prevented in the future?

Uncovering The Damage

Taking a glance back at the initial attack, Capita’s systems were compromised in March, causing a several-day service outage for many of their customers. At first, Capita denied that their customer data has been affected. However, this was quickly proved to not be the case, with reports released stating that as many as 350 UK retirement schemes had been affected. Leaked samples of the stolen data online showed that bank account details, passport photos and driver’s licenses had been accessed.

Fast forward to May, and a second Capita incident comes to light – this time, involving the long-term exposure of confidential data. This was attributed to Capital having failed to properly configure an Amazon Web Services (AWS) storage bucket.

Consumer Trust At Risk

With Capita’s systems used to administer pensions for several large and prominent organisations, including Royal Mail, Axa, Unilever, Marks and Spencer and a selection of local councils, the fallout from these two data breaches has been catastrophic.

Financially, Capita will be expecting losses of up to £20 million, after having to spend a large amount on specialist fees, recovery processes and remediation costs. However, the financial impact may be the least of their worries, with the brand now experiencing significant reputational damage.

Colchester Council is just one of the affected organisations that have expressed visible disappointment with Capita, stating that the outsourcer had “failed to maintain the necessary standards for data protection”.

This loss of customer trust is not only felt by Capita but by the pension schemes and financial organisations that they provide services to. The fact that a third party or supplier was the origin of the hack will do nothing to soften the blow for end customers, especially when their personal data is on the line. Ultimately, each business is accountable for the security of their customers’ information.

Why Cybersecurity Can’t Be The Last Priority

Digital transformation strategies have been front and centre for many organisations in the past few years, with each business looking to improve customer experiences and increase business efficiency. Consumers are increasingly demanding improved and frictionless customer experiences but any goodwill or advantage gained for firms will be lost if consumers don’t feel their data is secure.

The lesson that Capita teaches us is clear - digitising services cannot come at the cost of security. Cybersecurity has to be a core element within your digital transformation strategy, with organisations needing to proactively implement sufficient cybersecurity measures and practices to mitigate risk and safeguard customer data, rather than waiting for an incident to occur and cleaning up the mess.

For businesses that fail to afford cybersecurity the attention it needs and deserves, it’s only a matter of time until one weak element brings all the benefits crashing down, and a business loses the reputation they have built over years, in mere days.

Paul Holland is CEO at Beyond Encryption

You Might Also Read:

Who Foots the Bill For A Data Breach?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.