On July 30, Capital One Financial Corp., the fifth largest U.S.
credit card issuer, reported that approximately 106 million card
customers' and applicants' personal information was stolen
by a hacker in late March.
The breach implicated 140,000 Social Security numbers and 80,000
bank account numbers, as well as credit scores, payment histories
and credit limits of individuals associated with Capital One. The
stolen data was stored on the Amazon Web Services Inc. cloud and,
according to Capital One, was stolen via a misconfigured firewall
on an AWS bucket (i.e., a cloud server used to store sensitive
information).
Because its security defenses did not detect it, Capital One was
not alerted of the intrusion until July 17 — almost four
months later — when a third party notified Capital One of the
attack. Recent federal investigations identified the hacker as a
former employee of AWS.
