The Capital One Breach
The data of more than 100 million Capital One customers was compromised by a hacker after a cloud misconfiguration. Plus 6 million Canadian customers were also affected.
The hacker accessed credit applications, Social Security numbers and bank account numbers. This breach is so large that it’s in the same league as the Equifax 2017 hack.
Who Was The Hacker?
The FBI arrested Paige Thompson, a former engineer at Amazon Web Services (AWS). She admitted to being the hacker on GitHub.
Thompson used the alias “erratic” in her online conversations on social media. In a Twitter posting she wrote: “I’ve basically strapped myself with a bomb vest, … dropping capital ones dox and admitting it.”
The FBI arrested Thompson on Monday, July 29, for the theft, which occurred between March 12 and July 17. Computer fraud and abuse are punishable by up to five years in prison and a $250,000 fine.
How Did Thompson Get Into The Capital One System?
She illegally accessed data that was stored on cloud servers rented from Amazon Web Services (AWS) after finding the misconfigured firewall.
Capital One fixed what it called a “configuration vulnerability” and said it is “unlikely that the information was used for fraud or disseminated by this individual,” although investigations are ongoing, so we don’t know for sure.
Should Capital One Customers Be Worried?
If you made a credit-card application made between 2005 and early 2019, you should watch for any suspicious activity on your accounts.
The breach revealed personal information, such as names, addresses and dates of birth; and financial information, including self-reported income and credit scores.
According to Capital One, no credit-card account numbers or log-in credentials were compromised. However, 140,000 Social Security numbers were impacted. Capital One said that about 1 million social insurance numbers for their Canadian customers were compromised.
Capital One reported other data that was exposed included credit scores, credit limits, balances, payment history, contact information and fragments of transaction data from 23 days during 2016, 2017 and 2018.
Capital One is offering free credit monitoring for those impacted. They expect that this hack will cost them approximately $100 million to $150 million in 2019.
What Should Breach Victims Do?
They’ve set up a consumer website about the breach at www.capitalone.com/facts2019 that you should refer to if you’re worried that your information was compromised.
If you’re a Capital One customer, you should check your account online. You should also freeze your credit through each of the three main credit bureaus: Experian, Equifax and TransUnion.
It’s important to remain vigilant. Businesses should sign up for Dark Web Scanning to detect whether your confidential business information is there for cybercriminals to use.
Dark Web Scanning looks for data dumps within the black markets on the Dark Web that have anything to do with your organization. You’ll get an initial and ongoing scanning, with continuous monitoring and alerts if we find anything.
Businesses are signing up for Dark Web Scanning because they’re concerned that their data is being stolen and sold by criminals on the Dark Web. Many didn’t find out about their data being taken until a cybercriminal broke into their bank account or used their credit card. If they had signed up for Dark Web Scanning, they might have prevented this.
- It scans the Dark Web 24/7 to make sure your business data is safe.
- It’s a sophisticated monitoring solution that helps businesses of any size benefit from complete security and protection.
- It detects cyber threats that expose stolen business accounts, email addresses, patient information, and other confidential data on the Dark Web.
- Dark Web scanning employs both human and artificial intelligence to scan criminal operations in chat rooms, blogs, forums, private networks and on other sites.
- It observes and collects the vital intelligence needed to determine if your data exists on the Dark Web.
- It also does this in real-time and detects any of your compromised credentials or information before criminals can use it for profit or other crimes.
What Specifically Will Dark Web Scanning Detect?
Everything below, but not limited to:
- Credit Card Data
- Confidential Data from unsecured file transfers
- Leaked data from employees (intentional or not)
- Compromised accounts
- Your customers’ data that’s being sold
- Stolen Financial Data
- Stolen PayPal and other account credentials
- Trademark and Copyright Infringements
How Else Can You Protect Your Confidential Business Information?
When a news story comes out about a large corporate hack, businesses often scramble to learn how they can better protect their businesses. But this is the wrong time to start thinking about protecting your data.
Don’t wait until a breach occurs; start protecting your organization now. Educate your employees about the dangers of online crime and developing company procedures to prevent it from happening.
Prevention is always the best remedy. Make sure that your firewall is configured correctly and have us continuously, remotely monitor your network for intrusions.