Capital One Hacked, Information on 100,000 Customers Leaked

Capital One is one of the biggest credit card companies in the world. On July 29th 2019, Capital One made an announcement: it was the victim of one of the largest data breaches in financial sector history. A former software engineer for Amazon has been indicted on charges related to the hacking.

Here’s what we know:

Capital One has admitted that the personally identifiable information (PII) of over 100 million American and Canadian credit applicants’ information has been exposed. The organization did acknowledge that no credit card account numbers or authentication credentials were compromised in the hack. Additionally, they said that in 99 percent of the files, social security numbers were not compromised. The largest category of information that was accessed were individual and small business credit applications that span from 2005 to 2019.

The perpetrator, Paige Thompson of Seattle, Washington, was a former software developer for Amazon Web Services (AWS), which took advantage of a firewall misconfiguration to gain access to the information, AWS confirmed Monday. The vulnerability came as a result of a setup error and not a flaw within the massively popular AWS.

The breach occurred on March 22 to 23, 2019. Thompson was apprehended as a result of being reported to Capital One for storing incriminating evidence on her Github and Slack accounts. Capital One contacted the FBI on July 19, 2019 and after a short investigation, Thompson was arrested and indicted by the Western District of Washington.

Richard Fairbank, the CEO of Capital One, released the following statement:

“While I am grateful that the perpetrator has been caught, I am deeply sorry for what has happened. I sincerely apologize for the understandable worry this incident must be causing those affected and I am committed to making it right.”

For a full report of the event, visit: https://www.capitalone.com/facts2019/

Capital One has said that it will inform you if you have been a victim of this colossal attack, but, if like many of us, too much is at stake to wait for the organization to reach out to you, you can take some immediate steps to safeguard your personal information.

• Check your accounts - Account monitoring and fraud detection should be a major part of any action you take to secure personal information.
• Change passwords - One great way to at least feel more secure after a significant hack like this is to immediately change your passwords.
• Freeze your credit report - One option you can take to protect yourself is to freeze your credit report; this won’t let any credit reporting services check your credit, meaning if someone were to try to take money out in your name that the banks wouldn’t be able to authorize credit.
• Avoid scams - A large part of keeping any data secure is to not give unauthorized parties access to it. That means circumventing phishing attacks and other scams.
• Continued vigilance - Vigilance over your account information, your personally identifiable information, and your overall financial health is more critical than ever. As mentioned above, credit monitoring and fraud detection services give users tools to combat unauthorized access.

Maintaining online security for yourself and your business is more difficult than ever these days. To learn more about data security, subscribe to our blog or call Macro Systems today at 703-359-9211.