2019Data breach
Capital One cloud data breach
March 2019, discovered July 2019
An outside individual exploited a configuration vulnerability in Capital One's cloud environment to obtain credentials and copy data from cloud storage, according to Capital One. A security researcher reported the issue to Capital One in July 2019. The US Office of the Comptroller of the Currency later fined the bank for failing to establish effective risk assessment before moving IT operations to the cloud.
- Victim
- Capital One and its customers and applicants
- Sector
- Financial services
- Public attribution
- A former employee of a cloud provider was convicted in 2022 of wire fraud and computer intrusion offences over the breach (US Department of Justice).
Impact
Capital One said about 100 million people in the US and about 6 million in Canada were affected; the OCC assessed an 80 million US dollar civil money penalty.
Root cause
A cloud misconfiguration that let a web-facing component be abused to obtain credentials with access to stored data.
Lessons learned: the controls it teaches
- Apply least privilege to cloud roles so one compromised component cannot read everything.
- Use cloud security posture management to find misconfigurations continuously.
- Run a responsible disclosure programme; an outside report surfaced this breach.