Capital One Data Breach

What happened

An outside individual gained unauthorized access to Capital One's systems, obtaining personal information from credit card applications spanning from 2005 to early 2019. The compromised data included names, addresses, zip codes, phone numbers, email addresses, dates of birth, and self-reported income, as well as credit scores, credit limits, balances, and payment history.

Technical mechanism

The attacker exploited a misconfigured web application firewall (WAF) in Capital One's cloud environment, allowing them to access data stored in Amazon Web Services (AWS) S3 buckets.

Why it matters

One of the largest data breaches in history, highlighting severe risks associated with cloud security and misconfigured firewalls.

Impact

The breach affected approximately 100 million individuals in the United States and 6 million in Canada. About 140,000 Social Security numbers and 80,000 linked bank account numbers were compromised in the US, along with 1 million Social Insurance Numbers in Canada.

Response

Capital One fixed the configuration vulnerability, notified law enforcement, and offered free credit monitoring and identity protection to affected individuals. The attacker was arrested by the FBI.

Defensive lessons

• Ensure proper configuration and continuous monitoring of cloud environments.
• Implement least privilege access controls for cloud resources.
• Regularly audit and test web application firewalls and other security controls.

Evidence register

1. Capital One — Information on the Capital One Cyber Incident (verified)