Capita has warned it could face a financial hit of up to £20million as a result of a cyberattack last month that caused disruption for the outsourcer’s clients.
The group collects the BBC licence fee and has £6.5billion of public sector contracts. Capita was rocked by the hack last month as staff were locked out of key systems and clients’ services suffered.
Capita told investors on Wednesday that while it had been able to ‘significantly restrict’ the impact of the attack, it expects to incur costs of £15milion to £20million as a result.
The costs encompass ‘specialist professional fees’, recovery and remediation costs, and ‘investment to reinforce Capita’s ‘cyber security environment’.
Capita says it has taken further steps to ensure the integrity, safety and security of its IT infrastructure
However, the costs of the hack to Capita could well exceed these figures if regulators choose to impose a fine on the group.
The Financial Conduct Authority and Pensions Regulator have been in touch with Capita’s corporate clients, asking them to assess the impact on their end customers.
Capita has engaged with regulators and notified the Information Commissioner’s Office of the incident within the required 72 hours.
It also identified the breach within nine days, compared to an average of 197 days, according to IBM’s 2022 Cost of a Data Breach Report.
Capita said on Wednesday its own forensic work and that of third-parties had determined that some data was ‘exfiltrated’ – or taken – from less than 0.1 per cent of its server estate.
It added: ‘Capita has taken extensive steps to recover and secure the customer, supplier and colleague data contained within the impacted server estate, and to remediate any issues arising from the incident.
‘Capita is working closely with all appropriate regulatory authorities and with customers, suppliers and colleagues to notify those affected and take any remaining necessary steps to address the incident.
‘Capita has also taken further steps to ensure the integrity, safety and security of its IT infrastructure to underpin its ongoing client service commitments.’
As well as councils and the National Health Service, Capita holds contracts with government organisations like the National Cyber Security Centre.
It also provides services on behalf of the Cabinet Office, HM Revenue & Customs, the Ministry of Justice, numerous police forces, and runs the London Congestion Charge Scheme.
Among its private sector clients, Capita operates call centres for car manufacturer BMW, bookmaker William Hill, Thames Water, telecoms group O2, and the RSPCA.
Pre-tax profits slumped by 79 per cent to £61.4million in 2022 due to a major impairment charge for Capita in its portfolio division and the loss of earnings from its various disposals.
Capita said on Wednesday current trading remains in-line with expectations, amid ‘strong’ sales performane over the first four months of its financial year with revenues up 16 per cent year-on-year to £449million.
Capita shares fell 2.1 per cent to 33.6p in early trading, paring back 2023 gains to 33.3 per cent.
Analysts at Peel Hunt man maintained their ‘buy’ rating, with a target price of 48p.
Peel Hunt’s Christopher Bamberry said: ‘Hopefully Capita can now draw a line under the cyber incident, the uncertainty arising from which has weighed heavily on the shares.
‘Trading is in line and industry newsflow remains supportive.’
