Capita, the outsourcing group that runs crucial operations for the NHS and the military, was still restoring online services for customers on Monday morning as it confirmed a cyber-attack was to blame for a major IT outage that hit clients including local councils on Friday. The company was working over the weekend to try to repair systems for clients, which include agencies involved in critical national infrastructure. Some customers reported having to resort to using radios, pens and paper after the attack. “On Friday 31st March, Capita plc experienced a cyber incident primarily impacting access to internal Microsoft Office 365 applications,” the company said in a statement on Monday, referring to the suite of products that includes email, Teams virtual meetings and Word and Excel. “This caused disruption to some services provided to individual clients, though the majority of our client services remained in operation,” Capita added. However, Capita stopped short of detailing which of its customers had been affected. The company said it had restored staff access to internal applications and was “making good progress restoring remaining client services in a secure and controlled manner.” The outage on Friday triggered concern within the UK government, given that Capita, which employs more than 50,000 people in Britain, and is one of the government’s most important suppliers. The company has £6.5bn-worth of public sector contracts, spanning London’s congestion charge system to recruiting soldiers for the army. Its largest government customer is the Department for Work and Pensions, which has farmed out £2bn of work to Capita, mostly on its disability payment assessment services, although it also serves the National Cyber Security Centre, the Cabinet Office and other government agencies. Capita also holds contracts with the London boroughs of Barnet, and Barking and Dagenham, and with South Oxfordshire council, whose websites displayed messages on Friday saying that phone lines for benefits, council tax and business rates call centres were down. An internal investigation into the attack is continuing.