By
Godfrey Benjamin
April 18th, 2024
The hacker exploited a vulnerability in the firewall web application on the AWS servers and extracted crucial files from the Capital One directory.
In one of the biggest data heists, banking giant Capital One has reported a data breach of over 100 million customers across the US and Canada. According to the report by CNN, the hacker got access to access to customers’ credit card information and accounts.
Capital One said that the hacking attempt took place earlier this year in March 2019. However, it was identified a few days back on July 19. The hacker identified as Paige Thompson breached the Capital One server and got access to 1 million Canadian Social Insurance number, 80,000 bank account numbers and over 140,000 Social Security Numbers.
Besides, the US Department of Justice also found out that an undisclosed number of addresses, people’s names, credit limits, bank balances, credit score, and other information have been compromised.
A criminal complaint was filed against Paige Thompson, after which she was arrested on charges of sharing the information online. Thompson is a 33-year-old software engineer staying in Seattle and has previously worked at the Amazon Web Services (AWS). Note that Capital One has also been using the AWS servers for storing their crucial information. As per the court filing, she exploited a misconfigured web application firewall and got access to this massive chunk of data.
The Department of Justice said that Thompson was arrested this Monday in connection with the data breach.
The Events of the Hack
Thompson was caught after openly talking about the hacking event on the Microsoft-owned software development platform – GitHub. She posted this information on GitHub with her full name and boasted about the same on social media.
On one of the Slack channels, Thompson posted the complete method of how she breached the Capital One directory stored on Amazon servers and managed to extract files from there. In a post of Slack, she wrote:
“I wanna get it off my server that’s why Im archiving all of it lol”.
All she posted was through a screen name called “erratic” and used the same name for a Meetup chat room and her Twitter account.
However, one person saw this information on GitHub and soon informed Capital One of the leaked data, The banking giant soon filed a complaint with the FBI to proceed with the investigation against Thompson.
Reaction by Capital One
Capital One has assured that it has fixed the vulnerability but it is still investigating into the matter. The company further added that it is “unlikely that the information was used for fraud or disseminated by this individual”.
In another statement, the company also added that 99% of Social Security numbers were not compromised and moreover no credit card account numbers or their log-in were compromised.
Speaking on the matter, Capital One CEO and Chairman Richard D. Fairbank said:
“While I am grateful that the perpetrator has been caught, I am deeply sorry for what has happened. I sincerely apologize for the understandable worry this incident must be causing those affected and I am committed to making it right.”