Capita CEO steps down following ransomware attack, replaced by AWS VP

The CEO of outsourcing firm Capita is set to step down following a ransomware attack that accessed personal data of staff and clients. The attack could result in a heavy fine from the UK’s Information Commissioner’s Office (ICO).

Capita announced that Jon Lewis will retire as CEO by the end of 2023. Adolfo Hernandez, Vice President for Global Telecommunications at Amazon Web Services (AWS) will take over as CEO and Director.

“I also want to pay particular tribute to [Jon’s] leadership in recent months, during which he decided to delay his possible retirement from Capita due to the cyber incident we experienced in March,” said David Lowden, Chairman of Capita.

Capita is recovering from a Black Basta ransomware group attack in which Capita’s Office 365 software was hacked. Around 90 organisations said their data was breached in the attack. Capita runs services including pension schemes for local councils, the military, the NHS, and the BBC’s licence fee.

It is unclear whether Capita paid a ransom to the hackers.

The outsourcing firm expected the incident to cost between £15 million ($19 million) and £20 million ($25 million). These costs include specialist professional fees, recovery and remediation costs, and investment in cybersecurity decences. This estimated total is not believed to account for the potential fine from the ICO.

Companies that fail to keep personal data safe can have penalties levied on them by the ICO. In 2020, British Airways was fined £183 million ($233 million) before a reduction was issued placing the total at £20 million ($25 million). Reasons for this reduction were ‘mitigating factors’ like the company’s financial position amid the pandemic.

The recent attack from Black Basta follows a string of significant cyber attacks, including one on the BBC, British Airways, and Boots via a MOVEit hack.

Hungry for more tech news?

Sign up for your weekly tech briefings!