2023 Diageo pension schemes — Capita outsourcing breach; Black Basta disclosures
Data compromised
National Insurance numbers, home addresses, and DOBs referenced in Computing and successor member letters
Technical writeup
UK outsourcing giant Capita absorbed a late-March 2023 Black Basta intrusion that lingered on networks for roughly ten days before containment, later forcing pension clients—including Diageo's defined-benefit arrangements—to warn tens of thousands of members about likely theft of national insurance numbers, addresses, and birthdates. Diageo correspondence summarized Capita's May 2023 admission that member files were probably compromised and funded Experian monitoring for exposed cohorts.
Root cause
Ransomware and data theft attributed in open sources to Black Basta against Capita-managed pension infrastructure
References
- https://www.computing.co.uk/news/4116037/100-diagio-pension-members-breached-capita-attack
- https://www.theguardian.com/business/2023/may/09/capita-says-customer-data-accessed-in-cyber-attack
- https://www.scotsman.com/news/crime/diageo-pension-fund-members-caught-up-in-russia-linked-capita-cyberattack-4143864