Capital One targeted in massive data breach affecting more than 100 million people

ronjor · Jul 29, 2019

Associated Press Jul 29, 2019

Capital One says a hacker got access to the personal information of over 100 million individuals applying for credit.
The McLean, Virginia-based bank said Monday it found out about the vulnerability in its system July 19 and immediately sought help from law enforcement to catch the perpetrator.
The FBI has arrested the person, reportedly in Seattle, according to a report in The Washington Post.
Click to expand...

compleo · Jul 29, 2019

From their web site...https://www.capitalone.com/facts2019/

hawki · Jul 29, 2019

More details:

"Capital One says data breach affected 100 million credit card applications..."

https://www.washingtonpost.com/nati...828e68cb15f_story.html?utm_term=.474ad9b0d4b8

hawki · Jul 29, 2019

"Seattle Tech Worker Arrested In Huge Capital One Data Breach...

According to the FBI, Paige A. Thompson, 33, was able to get around a firewall and access Capital One servers to download huge amounts of personal data...

Thompson then posted about having the data on GitHub...

A GitHub user alerted Capital One about the possible breach in mid-July, and the company turned to the FBI to pursue criminal charges.
According to court documents, Thompson also posted on Twitter and Slack about trying to get rid of or distribute the data.

'I've basically strapped myself with a bomb vest, f--king dropping capital ones [documents] and admitting it,' she wrote in a Twitter direct message to the person who ultimately reported the breach to Capital One, court documents show...

Thompson worked at an unspecified cloud-computing company in Seattle,.."

https://patch.com/washington/seattle/seattle-tech-worker-linked-massive-capital-one-data-beach-fbi

Criminal Complaint/FBI Affidavit (Highly Detailed and Very Interesting):

https://www.scribd.com/document/420162221/Paige-Thompson-arrest-affidavit#fullscreen&from_embed

FanJ · Jul 29, 2019

I may be old, I may live in another country; I may be, well whatever ...
But could we please try to avoid to give full names here.
Yes, I do understand what this all might mean.
But nevertheless ...

guest · Jul 29, 2019

Capital One’s breach was inevitable, because we did nothing after Equifax
Another day, another massive data breach
July 29, 2019
https://techcrunch.com/2019/07/29/capital-one-breach-was-inevitable/

This time it’s the financial giant and credit card issuer Capital One, which revealed on Monday a credit file breach affecting 100 million Americans and 6 million Canadians. Consumers and small businesses affected are those who obtained one of the company’s credit cards dating back to 2005.

Why should we be surprised? Equifax faced zero fallout until its eventual fine. All talk, much bluster, but otherwise little action.
Lo and behold, it happened again. Without a congressional intervention, Capital One is likely to face largely the same rigmarole as Equifax did.

The Equifax incident should have sparked a fire under the credit giants. The breach was the canary in the coal mine.
The companies continued on with the mentality that “it could happen to us, but probably won’t.”
Click to expand...

guest · Jul 30, 2019

Hacker ID’d as former Amazon employee steals data of 106 million people from Capital One
July 30, 2019
https://arstechnica.com/information...al-one-and-takes-data-for-106-million-people/

Defendant Paige A. Thompson, 33, of Seattle was an employee of Amazon Web Services, The New York Times and Bloomberg News reported, citing company representatives.

One command executed in the firewall hack allowed the intruder to gain credentials for an administrator account known as *****WAF-Role. The command in turn enabled access to bank data stored under contract by a cloud computing company that went unnamed in court documents, but was identified as AWS by the NYT and Bloomberg.
Thompson allegedly used a VPN from IPredator and Tor in an attempt to cover her tracks. At the same time, Martini said that much of the evidence tying her to the intrusion came directly from things she posted to social media or put in direct messages.
Click to expand...

ronjor · Jul 30, 2019

Worried about the Capital One hack? Here's what to do

By Michelle Toh, CNN Business Updated 6:44 AM ET, Tue July 30, 2019
If you're a Capital One (COF) customer worried about your data, there are immediate steps you can take to safeguard your personal information, experts say.
Here's what you should do.
Click to expand...

ronjor · Jul 30, 2019

New York attorney general to probe Capital One data breach

July 30, 2019
NEW YORK (Reuters) - New York’s attorney general on Tuesday said her office will begin an immediate investigation into Capital One Financial Corp’s (COF.N) data breach, which the bank said involved the access of personal information belonging to about 100 million people in the United States.
Click to expand...

ronjor · Jul 30, 2019

Capital One Data Theft Impacts 106M People

Brian Krebs
Ray Watson, a cybersecurity researcher at cloud security firm Masergy, said the Capital One incident contains the hallmarks of many other modern data breaches.
“The attacker was a former employee of the web hosting company involved, which is what is often referred to as insider threats,” Watson said. “She allegedly used web application firewall credentials to obtain privilege escalation. Also the use of Tor and an offshore VPN for obfuscation are commonly seen in similar data breaches.”
“The good news, however, is that Capital One Incidence Response was able to move quickly once they were informed of a possible breach via their Responsible Disclosure program, which is something a lot of other companies struggle with,” he continued.
Click to expand...

Minimalist · Jul 30, 2019

Clues to the alleged Capital One hacker's crimes were all over the internet

The hacker who allegedly infiltrated Capital One to access personal information belonging to roughly 106 million people made it easy for the FBI to track her down: there were clues spread across a variety of popular websites.
Click to expand...

https://www.cyberscoop.com/paige-thompson-capital-one-slack-github-gitlab/

ronjor · Jul 30, 2019

Capital One shares drop on questions over hack

David Henry July 30, 2019 3 Min Read
(Reuters) - Capital One Financial Corp’s assurances that a major data breach would have a limited impact on customers or profits failed to convince investors on Tuesday, with the bank’s shares down more than 7%.
Analysts pointed to the legal expenses and possible regulatory penalties Capital One might face. By Tuesday morning, a class-action lawsuit had been filed in federal court and the state attorneys general of New York and Connecticut each said their offices would begin probing the matter.
Click to expand...

Minimalist · Jul 30, 2019

Here’s What You Need to Know About the Capital One Breach

It’s become a drearily familiar story: A data breach at a major company exposes troves of sensitive information, putting millions of people at risk of online fraud.

Last year, it was Marriott. The year before, Equifax.

This time, it’s Capital One, which said on Monday that a hacker had compromised the personal information of more than 100 million people, in one of the largest-ever thefts of data from a bank.
Click to expand...

https://www.nytimes.com/2019/07/30/business/capital-one-breach.html

ronjor · Jul 30, 2019

The Capital One breach is unlike any other major hack, with allegations of a single engineer wreaking havoc

Kate Fazzini@KateFazzini 30 July 2019
According to the indictment, Thompson exploited a misconfigured firewall in a cloud server used by Capital One. She allegedly used a Tor browser, which anonymizes a person’s online activities, to gain this access. She also used a virtual private network known as IPredator to further obscure her activities, according to the indictment.
Click to expand...

ronjor · Jul 30, 2019

Seattle woman charged in Capital One breach may have data from other companies

Mike Snider, USA TODAY Published 2:35 p.m. ET July 30, 2019 | Updated 3:27 p.m. ET July 30, 2019
"In several conversations, Erratic makes references to running a botnet of sorts, although it is unclear how serious those claims were," he wrote. "Specifically, Erratic mentions one botnet involved in cryptojacking, which uses snippets of code installed on Web sites – often surreptitiously – designed to mine cryptocurrencies."
Click to expand...

Minimalist · Jul 31, 2019

Cyber threats to banks

The sophistication of cyber-adversaries targeting banks, insurance companies, assets managers and similar finance firms can range from common script-kiddies to organised criminals and state-sponsored actors. And these attackers have an equally diverse set of motivations, as many see the finance sector as a tempting target due to its importance in national economies, according to a report by a cyber-security company.
Click to expand...

https://www.professionalsecurity.co.uk/news/commercial-security/cyber-threats-to-banks/

Minimalist · Jul 31, 2019

Capital One: Where Did the Bank Fail on Defense?

The first question after a major data breach usually is: How did the intruder get in? It's a frustrating query because the answer may not come for months until after an extensive forensics investigation is completed.

But with the Capital One data breach - one of the most extensive breaches of a U.S. financial institution - the answer was surprisingly contained in the criminal complaint.
Click to expand...

https://www.databreachtoday.com/capital-one-where-did-bank-fail-on-defense-a-12858

Minimalist · Jul 31, 2019

My info was in the Capital One breach. What should I do?

While the security world focuses on the aftermath of the Capital One data breach, the majority of those impacted by the incident are left with one big question: What do I do?
Click to expand...

https://www.cyberscoop.com/capital-one-data-breach-credit-freeze-credit-cards/

Minimalist · Jul 31, 2019

Capital One is a cautionary tale for companies rushing to embrace new tech

Capital One always said it wasn’t like other banks.

While other financial giants cautiously waded into their own digital transformations, Capital One’s leadership has sought to differentiate the $28 billion bank by investing in technology meant to modernize their business.
Click to expand...

https://www.cyberscoop.com/capital-one-hack-banking-security/

ronjor · Jul 31, 2019

Italy's UniCredit says carrying out own probe in relation to Capital One data breach

July 31, 2019
“On July 30, UniCredit became aware that its name has been mentioned in relation to the Capital One issue.
“UniCredit has contacted the relevant authorities and is actively investigating the matter,” UniCredit said in a statement.
The bank gave no further details.
Click to expand...

guest · Jul 31, 2019

Capital One breach also hit other major companies, say researchers
July 31, 2019
https://techcrunch.com/2019/07/31/capital-one-breach-vodafone-ford-researchers/

The data breach at Capital One may be the “tip of the iceberg” and may affect other major companies, according to security researchers.

Israeli security firm CyberInt said Vodafone, Ford, Michigan State University and the Ohio Department of Transportation may have also fallen victim to the same data breach that saw more than 106 million credit applications and files stolen from a cloud server run by Capital One by an alleged hacker, Paige Thompson, a Seattle resident, who was taken into FBI custody earlier this week.

It follows earlier reports from Forbes and security reporter Brian Krebs indicating that Capital One may not have been the only company affected, pointing to “one of the world’s biggest telecom providers, an Ohio government body, and a major U.S. university,” according to Slack messages sent by the alleged hacker.
Security researcher John Wethington told TechCrunch that based on public information — including the Slack channel of which the alleged hacker was a member — likely other companies had data stolen.
Click to expand...

Ford spokesperson Monique Brentley told TechCrunch that it’s “investigating the situation to determine if Ford information is involved.”

Meanwhile, Vodafone spokesperson Adam Liversage said the telecom giant was “not aware” of its data stolen in the Capital One breach.
And a spokesperson for Michigan State University said it receives “hundreds of threats and attacks on our system” and said it was “hard to know if one recently was the alleged hacker from the Capital One situation.”
Click to expand...

guest · Aug 1, 2019

ronjor said: ↑

Italy's UniCredit says carrying out own probe in relation to Capital One data breach
Click to expand...

UniCredit says no evidence of any customer data breach after Capital One case-memo to staff
August 1, 2019
https://www.reuters.com/article/us-...-capital-one-case-memo-to-staff-idUSKCN1UR593

UniCredit (CRDI.MI) has found no evidence so far of any customer data having been accessed or compromised in relation to a major data breach at Capital One Financial Corp (COF.N), the bank said in a memo to staff on Thursday.
A source close to the matter said UniCredit does not store any customer data on Amazon servers.
[7quote]
Click to expand...

ronjor · Aug 1, 2019

Lawmakers have questions for Capital One over its massive data breach. But they're also eyeing Amazon
By Brian Fung, CNN Business August 1, 2019

hawki · Aug 1, 2019

ronjor said: ↑

Lawmakers have questions for Capital One over its massive data breach. But they're also eyeing Amazon
By Brian Fung, CNN Business August 1, 2019
Click to expand...

Page has moved:

https://edition.cnn.com/2019/08/01/tech/capital-one-amazon-house-oversight/index.html

ronjor · Aug 1, 2019

Fixed the link.

Log in or Sign up

Capital One targeted in massive data breach affecting more than 100 million people

ronjor Global Moderator

compleo Registered Member

hawki Registered Member

hawki Registered Member

FanJ Updates Team

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

hawki Registered Member

ronjor Global Moderator

Log in or Sign up

Capital One targeted in massive data breach affecting more than 100 million people

ronjor Global Moderator

compleo Registered Member

hawki Registered Member

hawki Registered Member

FanJ Updates Team

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

hawki Registered Member

ronjor Global Moderator

Useful Searches