Capital One Data Breach

In July 2019, Paige Thompson, a former Amazon Web Services engineer, exploited a misconfigured firewall rule within Capital One's AWS environment. This vulnerability allowed her to bypass security controls and access databases containing highly sensitive customer information. The breach exposed data from over 100 million people in the US and 6 million in Canada. The stolen data included names, addresses, SSNs, and financial details from credit applications dating back to 2005. Thompson publicized her actions on platforms like GitHub and Slack, leading to her subsequent arrest by federal authorities. The incident served as a major case study in the 'Shared Responsibility Model' of cloud computing, demonstrating that even with secure infrastructure (AWS), client-side misconfiguration can lead to catastrophic data loss.

The incident occurred in the context of increasing reliance on cloud computing services, where organizations like Capital One utilize major providers such as Amazon Web Services (AWS). This reliance necessitates strict adherence to security best practices, making misconfiguration a persistent and high-risk threat vector.

The core vulnerability was a misconfigured AWS firewall (Security Group). This misconfiguration allowed Thompson to bypass the intended network segmentation and access data stored in S3 buckets and databases that should have been restricted. The attack vector was not a zero-day exploit, but rather a failure in the implementation of the principle of least privilege and network access control.

Vulnerabilities exploited

• AWS Misconfiguration (Security Group Rule Failure)

MITRE ATT&CK techniques

• T1046
• T1537

Paige Thompson was an individual hacker who gained notoriety for exploiting a major financial institution's cloud misconfiguration. Her actions were primarily motivated by demonstrating a vulnerability rather than financial gain, leading to her public arrest.

Aliases

• erratic

MITRE groups

• T1190

Known members

• Paige Thompson

Attribution sources

• FBI
• AWS
• Media Reports

Countries affected

• United States
• Canada

Data types

• Names
• Addresses
• Zip Codes
• Phone Numbers
• Social Security Numbers
• Financial Records
• Credit Application Data

Notable documents

• Credit Application Database Records (2005-2019)

Damage estimate is complex, involving regulatory fines, remediation costs, and potential class-action lawsuits.

Public reaction

The public reaction was characterized by alarm regarding the fragility of cloud security and the sheer scale of data exposure. It fueled widespread discussion about the necessity of robust security audits and compliance in the financial sector.

Political impact

The incident placed immense pressure on major financial institutions to overhaul their cloud security protocols. It led to increased scrutiny from federal regulators regarding the implementation of the Shared Responsibility Model.

Paige Thompson was arrested by federal authorities. The incident resulted in internal and external audits for Capital One, leading to significant changes in their cloud security posture.

Prosecutions

• Paige ThompsonArrested and charged

  Charge

  Unauthorized access to computer systems and theft of data

  Jurisdiction

  United States Federal

  Sentence

  Pending court proceedings

Civil lawsuits

• Potential class-action lawsuits from affected consumers

Policy changes

• Increased industry focus on cloud security best practices and configuration management.

Regulatory changes

• Heightened scrutiny from financial regulators (e.g., OCC, FDIC) regarding cloud security governance.

Security improvements

• Mandatory implementation of network segmentation and least privilege access controls in AWS environments.
• Enhanced internal auditing of firewall rules and security groups.

Significance

This breach is a landmark case study in cloud security, demonstrating that the failure point was not the underlying infrastructure (AWS) but the client's implementation of security controls. It codified the risks associated with misconfigured cloud firewalls, making it a primary reference point for cloud security architecture.

Legacy

The incident permanently elevated the importance of the 'Shared Responsibility Model' in corporate security discourse. It spurred the adoption of automated cloud security posture management (CSPM) tools across the financial and technology sectors.

Media partners

• The New York Times
• Reuters
• TechCrunch

Capital One implemented comprehensive security overhauls, including mandatory third-party audits and the adoption of automated security tooling to prevent similar misconfigurations.

Official documents

• FBI Press Releases regarding the arrest

References

1. [1]The New York Times reporting on the breach
2. [2]AWS Security Best Practices Documentation