Capital One Breach Affects 100 Million Customers

On July 29, Capital One Financial Corporation announced that it had suffered a breach on July 19. On that date, an outside individual illegally accessed the personally identifiable information (PII) of over 100 million of its customers.

The accused attacker, Paige A. Thompson, was arrested on charges in connection with the crime by federal agents. She is accused of accessing the customer data that the bank had stored in the cloud, via Amazon Web Services (AWS). Thompson is reported to have boasted of the breach online, which led to her rapid apprehension.

The hacked data included names, addresses, phone numbers, credit scores and credit limits of customers who applied for credit card products from 2005 through early 2019. Social Security Numbers, bank account numbers, and Canadian Social Insurance numbers were accessed. Over 100 million U.S. customers and over six million Canadian customers were affected.

The hacker, a former AWS employee, was able to gain access to the data through exploiting a misconfigured web application firewall. Capital One has indicated that the configuration has since been fixed. It has also indicated that, to its knowledge, the breached customer data has not been posted online, though the security implications may become apparent at a later date. They have apologized for the breach, and expressed their commitment to making things right.

ACA Aponix Guidance

ACA Aponix recommends taking the following actions regarding the Capital One breach:

• Closely monitor financial accounts, both on a corporate and an individual level, for unusual activity.
• Inform staff of the breach, and provide similar guidance regarding personal accounts.
• Freeze credit with the major credit bureaus to prevent misuse of misappropriated social security numbers
• Ensure proper configuration is in place for all company data stored in cloud environments, going beyond default configurations to address the specific needs of the company.

How We Help

Businesses need to ensure all aspects of their data are secured. We offer the following solutions that can help your firm ensure strong security:

• Cybersecurity and technology risk assessments
• Phishing testing and cyber awareness
• Penetration testing and vulnerability assessments
• Policies, procedures, and governance
• Cyberincident response planning
• Threat intelligence
• Microsoft^® Office 365^® security assessments

If you have any questions, please contact your ACA Aponix consultant or email us at info@acaaponix.com.