New Information Comes to Light and More SSNs Compromised in Capital One Data Breach

It seems that data breaches from 2019 are flooding the internet with flashbacks and more damage. Last Friday, The Bleeping Computer reported that more social security numbers than previously thought were exposed in the July 2019 Capital One data breach. 

What Happened?

Ex Amazon Web Services (AWS) employee Paige Thompson was arrested and charged with the crime of infiltrating Capital One’s AWS cloud server and exfiltrating more than 100 million customers’ information which included their names, date of birth, email address, transactions, credit scores, payment history, balances, social security numbers, and bank account details. 

At the time, the company calculated that Thompson stole roughly 140,000 social security numbers and 80,000 bank account numbers. She also used the compromised servers to mine for cryptocurrency. Capital One was not her only victim. The list of affected companies includes Vodafone, Ford, Unicredit, the Ohio Department of Transportation, and Michigan State University.

Thompson was caught because she bragged about the theft on GitHub shortly after completing the heist. 

An Investigation Reveals New Information

Although it’s now two years after the incident, a thorough investigation reveals that Thompson did indeed access more customer social security numbers than previously assumed. Capital one sent out a response notice to its customers, which read:

“Immediately after the 2019 data security incident, we conducted an analysis with the assistance of an external third-party expert to determine what information was accessed by the unauthorized individual,” Capital One said. “At that time, we did not identify you as one of the individuals whose Social Security number was part of the accessed data.”

“Recently, Capital One re-examined the files that were impacted by the 2019 data security incident using new and more advanced tools. As part of this analysis, we determined that your Social Security number was among the data to which the unauthorized individual gained access.”

This additional disclosure is expected to cost Capital One $100-$150 million in notifications, legal fees, security improvements, and free monitoring for Capital One customers. The company does carry cybersecurity insurance, so a lot of that will be covered. They already paid an $80 million fine to the Office of the Comptroller of the Currency (OCC) for “its failure to protect its customers’ personal and financial information.” The OCC commented at the time that, “The OCC took these actions based on the bank’s failure to establish effective risk assessment processes prior to migrating significant information technology operations to the public cloud environment and the bank’s failure to correct the deficiencies in a timely manner.”

What Does This Mean for Capital One Customers?

After the recent notification Capital One did note that no evidence suggests that any of the data found was used for fraud or identity theft. However, 100 million people haven’t been asked that question either.

Data breaches can have a devastating effect on the victims. Even just a stolen name and email address could easily put someone at risk of phishing campaigns. Bank account details and social security numbers raise the risk even more for fraud, theft, and bank account takeover. 

Capital One customers and anyone involved in a data breach should be aware that even though the company may assure them that there is no danger of their information being used, there could be. Take these steps to protect yourself against identity theft and fraud:

• Be very watchful for phishing emails and scam phone calls, especially anyone claiming to be calling from Capital One. 

• Never click links in email or text unless you know exactly who it came from. 

• Stay on top of the latest scams and fraud techniques so you can protect yourself.

• Sign up for credit and identity theft monitoring to let the experts watch your accounts and notify you of anything suspicious. 

• Never download software from untrusted sources.

• Keep all your devices updated with the latest security patches.

• Install and use good, robust antivirus software.