Capital One targeted in massive data breach affecting more than 100 million people

guest · Aug 2, 2019

Amazon quizzed over AWS security following Capital One leak
August 2, 2019
https://www.computing.co.uk/ctg/news/3079954/amazon-security-capital-one

Politicians in the US have quizzed Amazon about its security practices after a former employee was accused of causing a major data breach at Capital One.
A group of Republicans in the House of Representatives asked the e-commerce giant about its security protocols on Thursday, according to Reuters.

"The Capital One data was stored on a cloud storage service provided by Amazon Web Services," they wrote. "The outside individual who accessed the data was allegedly a former AWS employee."

They went on to ask the company to attend a meeting about "this serious matter". The letter added: "We respectfully request a staff-level briefing no later than August 15, 2019 on the current status of AWS security protocols in place to ensure the security of sensitive personal and government data."
Click to expand...

hawki · Aug 2, 2019

mood said: ↑

Amazon quizzed over AWS security following Capital One leak
August 2, 2019
https://www.computing.co.uk/ctg/news/3079954/amazon-security-capital-one
Click to expand...

"...It’s unclear whether her technical insight from working at Amazon may have provided her an advantage in helping her hack into Capital One’s proprietary software running on Amazon’s servers.

Capital One noted that the “vulnerability is not specific to the cloud,” and Amazon spokesman Grant Milne said that Amazon Web Services was “not compromised” in the attack..."

https://www.washingtonpost.com/tech...t-profitable-business/?utm_term=.b6bf45883329

compleo · Aug 2, 2019

What We Can Learn from the Capital One Hack

guest · Aug 3, 2019

Capital One and GitHub are being sued over allegations of not doing enough to protect customers
August 2, 2019
https://www.businessinsider.de/capi...breach-class-action-lawsuit-negligence-2019-8

Capital One and the Microsoft-owned GitHub are facing a class action lawsuit over allegations of not doing enough to protect the personal information of more than 100 million bank customers who were affected by a massive data breach.

The lawsuit was filed Thursday in federal district court on behalf of plaintiffs Aimee Aballo and Seth Zielicke, though if granted class action status, it could include the 106 million Capital One customers who the bank revealed this week were affected by the breach in question.

"This is the kind of the result of negligence from two companies who are sophisticated and should've done better," Sabita Soneji, the lead lawyer for the plaintiffs, told Business Insider. "They shirked their duty to protect this data."
Click to expand...

ronjor · Aug 3, 2019

Another Breach: What Capital One Could Have Learned From Google's 'BeyondCorp'
Posted by EditorDavid on Saturday August 03, 2019 @03:34PM from the firewalls-don't-work dept

In a nutshell, BeyondCorp is a set of practices that effectively puts "zero trust" in the networks themselves, moving access control and other authentication elements to individual devices and users. This eliminates traditional firewalls (and in nearly all instances, VPNs) because there is no longer any need for such devices or systems that, once breached, give an attacker access to internal goodies.
Click to expand...

Minimalist · Aug 5, 2019

How to protect yourself in a data breach if your bank gets hacked

Events like the recent Capital One breach or the broader Equifax hack in 2017 can leave you feeling vulnerable and helpless -- and rightfully so. It's one thing to have your Facebook or Twitter account compromised, but being the victim of a financial institution getting hacked adds a whole new level of distress.

Our bank accounts hold some of our most personal information such as social security numbers, our credit and debit card numbers, where we live and our financial records.

When someone has all of your private information, it's natural to feel like there's nothing you can do to prevent any further damage. But that's not the case -- there's a lot you can do to make sure your credit, identity and online accounts remain yours.
Click to expand...

https://www.cnet.com/how-to/how-to-protect-yourself-in-a-data-breach-if-your-bank-gets-hacked/

Minimalist · Aug 5, 2019

Security researchers warned for years about the cloud-security flaw used in the massive Capital One hack, but Amazon apparently leaves it up to customers to protect

The vulnerability that led to the Capital One hack was known by security researchers since 2014, according to a report in The Wall Street Journal on Monday.
Click to expand...

https://www.businessinsider.com/cap...bility-on-cloud-amazon-known-for-years-2019-8

guest · Aug 5, 2019

Capital One's Breach May Be a Server Side Request Forgery
August 5, 2019
https://www.inforisktoday.com/capital-ones-breach-may-be-server-side-request-forgery-a-12871

But enough detail has been released so far to give security professionals enough to ponder about how one of the biggest breaches possibly occurred.

Evan Johnson, who is part of Cloudflare's product security team, writes that SSRF is a bug hunter's dream in that it can yield critical vulnerabilities. [...]
Johnson outlines how a SSRF attack could have been pulled off against Capital One. AWS uses what's called a metadata service, which supplies fresh IAM credentials for a new image. The metadata service runs on a hypervisor, and an HTTP request to an IP address - for AWS it is 169.254.169.254 - can obtain new temporary credentials.

"The metadata service is amazing," Johnson writes. "It provided customers with a mechanism to write software that securely authenticates with AWS services without requiring any special code or handling of real IAM keys (which have been the source of many other breaches)."
But the request to the metadata service isn't authenticated or authorized, Johnson writes.
Click to expand...

ronjor · Aug 5, 2019

Capital One Data Breach Spurs More Lawsuits

Akshaya Asokan (asokan_akshaya) August 5, 2019
GitHub Also Sued for Allegedly Not Removing Data Related to Intrusion Akshaya Asokan
Click to expand...

ronjor · Aug 6, 2019

Senator Wyden wants answers from Amazon on Capital One hack

by Monica Nickelsburg on August 6, 2019
“When a major corporation loses data on a hundred million Americans because of a configuration error, attention naturally focuses on that corporation’s cybersecurity practices,” Wyden’s letter says. “However, if several organizations all make similar configuration errors, it is time to ask whether the underlying technology needs to be made safer, and whether the company that makes it shares responsibility for the breaches.”
Click to expand...

ronjor · Aug 14, 2019

Capital One hacker took data from more than 30 companies, new court docs reveal

By Catalin Cimpanu for Zero Day | August 14, 2019
New court documents reveal the government is investigating the Capital One hacker for 30+ other breaches
Click to expand...

.

guest · Aug 16, 2019

Capital One management was alerted by staff of multiple security issues prior to data breach
Employees were unhappy that routine cybersecurity measures were being neglected
August 16, 2019
https://www.computing.co.uk/ctg/new...agement-of-multiple-issues-before-data-breach

Capital One employees had reportedly informed the bank's internal auditors and other senior executives about staffing and security issues before massive breach of the confidential data.

According to a report by the Wall Street Journal, many members of Capital One's cybersecurity team believed that understaffing had led to routine cybersecurity measures being neglected and had discussed all those issues with the management.
In 2018 alone, about one-third staff of the cybersecurity unit left the company, according to the WSJ sources.
Click to expand...

guest · Aug 21, 2019

Suspect in huge Capital One breach seeks release from jail
August 20, 2019
https://www.660citynews.com/2019/08/20/suspect-in-huge-capital-one-breach-seeks-release-from-jail/

Paige Thompson, of Seattle, was arrested last month after the FBI said she obtained personal information from more than 100 million Capital One credit applications.

Prosecutors have asked for her to remain in custody pending trial, saying she presents a flight risk and a danger to herself and others. But her attorneys said in court documents Tuesday the government has made no such showing, and it’s more likely she will try to harm herself if she is forced to remain jailed with men.
The American Civil Liberties Union also asked the court to release her.
Click to expand...

guest · Aug 22, 2019

Consumer Watch: Why you should be checking your email after the latest data breach
August 22, 2019
https://okcfox.com/news/consumer-wa...cking-your-email-after-the-latest-data-breach

Once your information is out there, it's out there. This means that if you have been the victim of a data breach, you always must be on the lookout for identity theft.
Right now, a class action lawsuit against Capital One is in the works. This is because of the breach happened in March, and that the public learned about it in early August. Internet security experts say it’s important for consumers not to forget about any breaches they are involved in as time passes.

However, PCMag says most people should be worried about targeted phising attacks. Since so many emails were compromised-- there is a chance scammers will be sending you fake emails trying to trick you into giving up even more of your personal information.

“Unfortunately, there is still a lot that could happen-- the information that was exposed could be used to create targeted phising attacks, perhaps even pretending to be remediation for the attack itself,” warns Eddy.
When using your email, be especially cautious with the messages you open, and never click on links you didn’t ask for. You can also ask for a credit freeze, so that no new accounts can be opened in your name, even by yourself. This is especially useful if you think you have already been the victim of fraud. You can freeze your credit until you get disputed account resolved.
Click to expand...

Minimalist · Aug 23, 2019

Capital One hacking suspect Paige Thompson appears in court, ordered to remain in custody

A federal judge in Seattle ordered Paige Thompson, a former Amazon employee accused of hacking Capital One and dozens of other companies, to remain in federal custody as her trial proceeds.
Click to expand...

https://www.geekwire.com/2019/capit...hompson-appears-court-ordered-remain-custody/

guest · Aug 28, 2019

Indictment says accused Capital One hacker also used exploited cloud servers for cryptojacking
August 28, 2019
https://www.geekwire.com/2019/accus...vers-cryptojacking-scheme-indictment-alleges/

A federal grand jury indicted Paige Thompson, a former Amazon engineer, on multiple counts of wire fraud and computer fraud on allegations that she not only stole data but also mined cryptocurrency after infiltrating the cloud servers of Capital One and more than 30 other companies.

While the alleged incidents of data theft have been widely documented, the indictment marks first time that prosecutors have publicly alleged that Thompson also illicitly used her access to the servers to mine cryptocurrency, a practice commonly known as cryptojacking.
Click to expand...

ronjor · Sep 5, 2019

Accused Capital One hacker pleads not guilty to all charges

Written by Jeff Stone Sep 5, 2019
Paige Thompson has pleaded not guilty to all charges in connection with a data breach at Capital One that resulted in the compromise of information about roughly 106 million people.
Click to expand...

guest · Oct 11, 2019

Capital One Hacking Trial Delay Likely
Prosecutors, Defense Attorneys Ask Judge for Delay, Citing Massive Amounts of Data to Review
October 11, 2019
https://www.databreachtoday.com/capital-one-hacking-trial-delay-likely-a-13236

Defense and prosecution attorneys are asking for a delay in the trial of alleged Capital One hacker Paige A. Thompson, citing the overwhelming amount of digital evidence in the case and the ongoing forensics investigation. Prosecutors also expect to file additional charges.

FBI agents are still sorting through between 20 and 30 terabytes of data that Thompson allegedly stole over the course of several months and stored in devices at her Seattle-area home, according to newly filed court documents.

"This case involves an immense amount of electronic discovery, well beyond the typical matter," according to motion filed by federal prosecutors this week. "Approximately 20-30 terabytes of electronic data currently are under review and being processed for inspection and/or production. Moreover, this case involves sensitive material, beyond the typical matter."
Investigators sorting the data found traces of "malware" within some files, the new court documents from prosecutors state. Because the data includes large amounts of sensitive personally identifiable information, the investigation is proving to be time-consuming, the documents note.
Click to expand...

guest · Oct 24, 2019

U.S. Senators ask FTC to probe Amazon Over Capital One hack - WSJ
October 24, 2019
https://www.reuters.com/article/cap...mazon-over-capital-one-hack-wsj-idUSL3N2792Z4

Democratic Senators are asking the U.S Federal Trade Commission to probe Amazon.com Inc on concerns that the company ignored security warnings prior to the Capital One hack, the Wall Street Journal reported on Thursday.

Earlier this year, Capital One Financial Corp had said that personal information including names and addresses of about 100 million individuals in the United States and six million people in Canada were compromised from Amazon’s cloud- computing system where information was stored.
Amazon, FTC and Capital One did not immediately respond to Reuters requests for comment. (Reporting by Amal S in Bengaluru; Editing by Arun Koyyur)
Click to expand...

WSJ: Senators Ask FTC to Investigate Amazon Over Capital One Hack [paywalled]

guest · Oct 24, 2019

Elizabeth Warren’s move on Amazon over Capital One hack is a warning shot to cloud providers
October 24, 2019
https://www.cnbc.com/2019/10/24/eli...zon-could-be-a-precursor-to-sifmu-status.html

Regulators have been asking for years whether banks’ use of a narrow set of cloud providers creates a systemic risk to the financial system.

Now the theory will be tested in public view as Democratic presidential candidate Sen. Elizabeth Warren, D-Mass., has asked the Federal Trade Commission to explore Amazon’s role in a recent security breach that happened at Capital One.
As in most breaches that involve a cloud service provider, Amazon has sought to stay at arm’s length from the problem.
A question of systemic importance
But regulators across the Western world, not only in the United States, have been growing increasingly concerned about how a cloud security breach could impact the financial sector.
Click to expand...

guest · Nov 5, 2019

Alleged Capital One hacker released from federal custody
November 5, 2019
https://www.zdnet.com/article/alleged-capitalone-hacker-released-from-federal-custody/

The alleged Capital One hacker, Paige Thompson, was released from federal custody on Tuesday as she awaits her trial.
The decision to keep her in federal custody was reversed on Monday however, with the presiding judge citing that Thompson does not pose enough of a threat to the community or herself to warrant being put in jail as she awaits trial.

As part of the conditions for her release, US District Judge Robert Lasnik has ordered for Thompson to be moved to a federal halfway house. While there, Thompson will be subjected to GPS monitoring at all times and is prohibited from accessing the internet or using computers, cellphones, or any other electronic device unless she has received permission from court.

Thompson was arrested in July and currently faces indictments for wire fraud, and computer fraud and abuse.
Her trial is set for March next year.
Click to expand...

guest · Nov 8, 2019

Capital One replaces security chief after data breach
November 7, 2019
https://techcrunch.com/2019/11/07/capital-one-security-chief-shuffle/

Capital One has replaced its cybersecurity chief four months after the company disclosed a massive data breach involving the theft of sensitive data on more than 100 million customers.
A spokesperson for Capital One confirmed the news in an email to TechCrunch.

“Michael Johnson is moving from his role as chief information security officer to serve as senior vice president and special advisor dedicated to cyber security,” said the spokesperson.
The Wall Street Journal first reported the news.

Capital One continues to assess the aftermath from its July data breach, which saw a hacker take millions of credit card application data between 2005 and 2019 from customers applying for credit cards. The data leaked also included names, addresses, postal addresses, phone numbers, email addresses, dates of birth and self-reported income, as well as credit scores and credit limits.
Click to expand...

guest · Dec 13, 2019

Consumers seek Capital One data from Amazon servers in lawsuit over data breach
December 11, 2019
https://legalnewsline.com/stories/5...om-amazon-servers-in-lawsuit-over-data-breach

Capital One and Amazon are facing a proposed class action lawsuit stemming from a March data breach and allegations they falsely marketed their public cloud software as safe.

Andrew Broderick, Jacqueline Burke and others, each individually and on behalf of all others similarly situated, filed a complaint Nov. 15 in the U.S. District Court for the Eastern District of Virginia against Capital One Financial Corp., Capital One Bank NA, Amazon.com Inc. and Amazon Web Services Inc. alleging violation of the Racketeer Influenced and Corrupt Organization Act (RICO), fraud by misrepresentation, unjust enrichment and other claims.

The plaintiffs allege that the defendants "orchestrated a massive migration of highly sensitive data to a public cloud under the cover of false statements and Potemkin security software," and falsely marketed the software to consumers and regulators as safe.
The plaintiffs are seeking an injunction ordering the removal of sensitive Capital One data from Amazon's cloud servers.
Click to expand...

guest · May 29, 2020

Capital One Must Turn Over Mandiant's Forensics Report
Data Breach Class Action Lawsuit Plaintiffs Have Been Seeking the Findings
May 29, 2020
https://www.inforisktoday.com/capital-one-must-turn-over-mandiants-forensics-report-a-14352

Capital One has been ordered by a federal judge to turn over the results of a digital forensics investigation into its 2019 data breach, which has been sought by plaintiffs in a class-action lawsuit.
The report could provide further insight into what went wrong in one of the most significant breaches of a financial institution in history.
Click to expand...

guest · Jun 13, 2020

Here's what that Capital One court decision means for corporate cybersecurity
June 11, 2020
https://www.cyberscoop.com/capital-one-incident-response-mandiant-decision/

When a judge ruled last month that Capital One must provide outsiders with a third-party incident response report detailing the circumstances around the bank’s massive data breach, the cybersecurity world took notice.

The surprise decision, in effect, determined that Capital One would need to provide the forensic details — warts and all — about the hack to attorneys representing a group of customers suing the bank. It’s the kind of report that, if made public, could highlight technical and procedural failures that made it possible for a single suspect to allegedly collect gigabytes of data about 100 million people from a bank with $28 billion in revenue.

“This type of directive from the judge could strike fear in the hearts of every company that’s ever hired a vendor to understand and improve their cyber posture,” said Norma Krayem, vice president and chair of the cybersecurity, privacy and innovation practice at Van Scoyoc Associates.
Click to expand...

Log in or Sign up

Capital One targeted in massive data breach affecting more than 100 million people

guest Guest

hawki Registered Member

compleo Registered Member

guest Guest

ronjor Global Moderator

Minimalist Registered Member

Minimalist Registered Member

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Capital One targeted in massive data breach affecting more than 100 million people

guest Guest

hawki Registered Member

compleo Registered Member

guest Guest

ronjor Global Moderator

Minimalist Registered Member

Minimalist Registered Member

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches