Capital One: The $190 Million 'Inside' Cyber-Breach

TL;DR: In 2019, a former Amazon Web Services (AWS) engineer, Paige Thompson, hacked into Capital One's cloud infrastructure and exfiltrated the personal data of over 106 Million customers. The breach was executed via a Server-Side Request Forgery (SSRF) attack, exploiting a misconfigured open-source Web Application Firewall (WAF) that Capital One had deployed on its AWS instances. This report dissects the forensic breakdown of the "Cloud Configuration Gap," the historic $80 Million OCC fine, and the $190 Million class-action settlement that redefined corporate liability in the age of cloud migration.

📂 Intelligence Snapshot: Case File Reference

Introduction: The "Cloud" Banking Pioneer

Capital One was a pioneer in the financial sector, becoming one of the first major U.S. banks to move its entire production infrastructure to the public cloud. While the company marketed this move as a leap forward in security and agility, the 2019 breach revealed a catastrophic failure in Cloud Governance. The bank had migrated its data at a velocity that outpaced its ability to audit its own security configurations, creating a "Shadow Vulnerability" that was eventually discovered by an individual with deep insider knowledge of the underlying AWS architecture.

The Forensic Mechanics: The SSRF Attack Vector

The breach was not the result of a brute-force attack or a sophisticated zero-day exploit, but rather a fundamental failure in Web Application Firewall (WAF) configuration.

• The Entry Point: The hacker targeted a misconfigured WAF. She utilized an SSRF (Server-Side Request Forgery) attack, which tricked the Capital One server into making an unauthorized request to the AWS Metadata Service.
• The Metadata Theft: By querying the metadata service, the hacker obtained temporary security credentials for a highly privileged "IAM Role" (Identity and Access Management). This role had excessive permissions, allowing the hacker to bypass multiple layers of encryption.
• The Exfiltration: Using these stolen credentials, the hacker listed and downloaded over 700 S3 buckets (cloud storage) containing roughly 30GB of data, including Social Security numbers, bank account details, and credit scores.
• The Digital Trail: Thompson was apprehended after she boasted about the breach on GitHub and Slack, using her real handle "erratic." Forensic IT auditors traced the IP addresses used in the data transfer back to her local hardware.

The Regulatory Hammer: $80 Million and 'Project Fire'

In August 2020, the Office of the Comptroller of the Currency (OCC) issued a scathing assessment of Capital One’s internal controls.

• The Finding: The OCC ruled that the bank’s board failed to provide effective oversight of the risk management of its cloud environment. Specifically, the bank had ignored multiple internal audit warnings about "configuration gaps" in its WAF.
• The Penalty: The $80 Million civil penalty was accompanied by a "Cease and Desist" order that forced the bank to overhaul its entire cybersecurity infrastructure under a program internal sources called "Project Fire."
• The Governance Lesson: This was the first major fine where a regulator explicitly penalized a board of directors for failing to understand the technical nuances of Cloud Security.

🔍 Forensic Indicators: Signals of 'Configuration Vulnerability'

The Capital One case serves as the definitive study in "Cloud Misconfiguration Risk."

1. Abnormal 'Metadata Service' Query Volume

A primary forensic indicator was the "Outbound Request Pattern." In the hours leading up to the data exfiltration, the WAF server showed an abnormal spike in requests to the AWS metadata IP address (169.254.169.254). In a secure environment, any request for "Credentials" from a public-facing server should trigger an immediate Forensic Lockout.

2. Presence of 'Over-Privileged' IAM Roles

Forensic auditors looked at the "Principle of Least Privilege." The IAM role assigned to the WAF server had "Read" access to hundreds of S3 buckets that were completely unrelated to the firewall's function. This "Permissions Bloat" is a primary forensic indicator of "Lazy Security Architecture."

3. Disconnect Between 'Cloud Migration Speed' and 'Audit Cadence'

Forensic analysis of the bank's internal project timelines showed that new cloud instances were being spun up faster than the security team could perform Security Group Audits. This "Operational Velocity Gap" is a primary indicator of a company that has prioritized Time-to-Market over Data Integrity.

Frequently Asked Questions (FAQ)

How did the hacker get into Capital One?

The hacker used a technique called SSRF to trick a Capital One server into giving up its secret access keys. Once she had those keys, she was able to look through the bank's storage files and download the personal information of millions of people.

Was my Social Security number stolen?

The breach affected roughly 100 million people in the U.S. and 6 million in Canada. While not everyone's SSN was taken, about 140,000 SSNs and 80,000 linked bank account numbers were compromised.

Was this Amazon's fault?

No. While the hacker was a former AWS employee, the vulnerability was caused by how Capital One configured its own software on the Amazon servers. Regulators ruled that Capital One was 100% responsible for securing its own "portion" of the cloud.

Did Capital One pay compensation?

Yes. Capital One reached a $190 million settlement in 2022 to compensate customers for identity theft protection and for the time they spent dealing with the fallout of the breach.

What is SSRF?

Server-Side Request Forgery (SSRF) is a type of attack where a hacker tricks a web server into making requests to internal services that should not be accessible from the outside.

Conclusion: The Death of 'Cloud Hubris'

The Capital One scandal is the definitive study of "Configuration Risk." It proves that the most advanced technology in the world is useless if the "Settings" are wrong. By failing to secure the "Door" to its cloud storage and ignoring its own internal auditors, Capital One's leadership successfully manufactured a massive data leak. For the banking world, the legacy of 2019 is the Death of 'Cloud Hubris'—the realization that moving to the cloud requires more oversight, not less. Ultimately, it proves that the most expensive "Cloud" a company can buy is the one that rains its customers' data onto the internet.

Next in The Vault (SEMANTIC SILO): Capita: The 2023 Data Breach Scandal - Forensic Analysis of the 'Black Basta' Ransomware Attack and the Failure of Outsourced Security

Keywords: Capital One cyber breach scandal summary, Capital One SSRF attack forensic analysis, Paige Thompson hacker case, cloud configuration security risk, Capital One $190 million settlement, AWS metadata service vulnerability, financial data breach 2019.