New Information Comes to Light and More SSNs Compromised in Capital One Data Breach

Posted on by Dawna M. Roberts in News April 09, 2021

It seems that data breaches from 2019 are flooding the internet with flashbacks and more damage. Last Friday, The Bleeping Computer reported that more social security numbers than previously thought were exposed in the July 2019 Capital One data breach. 

What Happened?

Ex Amazon Web Services (AWS) employee Paige Thompson was arrested and charged with the crime of infiltrating Capital One’s AWS cloud server and exfiltrating more than 100 million customers’ information which included their names, date of birth, email address, transactions, credit scores, payment history, balances, social security numbers, and bank account details. 

At the time, the company calculated that Thompson stole roughly 140,000 social security numbers and 80,000 bank account numbers. She also used the compromised servers to mine for cryptocurrency. Capital One was not her only victim. The list of affected companies includes Vodafone, Ford, Unicredit, the Ohio Department of Transportation, and Michigan State University.

Thompson was caught because she bragged about the theft on GitHub shortly after completing the heist. 

An Investigation Reveals New Information

Although it’s now two years after the incident, a thorough investigation reveals that Thompson did indeed access more customer social security numbers than previously assumed. Capital one sent out a response notice to its customers, which read:

“Immediately after the 2019 data security incident, we conducted an analysis with the assistance of an external third-party expert to determine what information was accessed by the unauthorized individual,” Capital One said. “At that time, we did not identify you as one of the individuals whose Social Security number was part of the accessed data.”

“Recently, Capital One re-examined the files that were impacted by the 2019 data security incident using new and more advanced tools. As part of this analysis, we determined that your Social Security number was among the data to which the unauthorized individual gained access.”

This additional disclosure is expected to cost Capital One $100-$150 million in notifications, legal fees, security improvements, and free monitoring for Capital One customers. The company does carry cybersecurity insurance, so a lot of that will be covered. They already paid an $80 million fine to the Office of the Comptroller of the Currency (OCC) for “its failure to protect its customers’ personal and financial information.” The OCC commented at the time that, “The OCC took these actions based on the bank’s failure to establish effective risk assessment processes prior to migrating significant information technology operations to the public cloud environment and the bank’s failure to correct the deficiencies in a timely manner.”

What Does This Mean for Capital One Customers?

After the recent notification Capital One did note that no evidence suggests that any of the data found was used for fraud or identity theft. However, 100 million people haven’t been asked that question either.

Data breaches can have a devastating effect on the victims. Even just a stolen name and email address could easily put someone at risk of phishing campaigns. Bank account details and social security numbers raise the risk even more for fraud, theft, and bank account takeover

Capital One customers and anyone involved in a data breach should be aware that even though the company may assure them that there is no danger of their information being used, there could be. Take these steps to protect yourself against identity theft and fraud:

  • Be very watchful for phishing emails and scam phone calls, especially anyone claiming to be calling from Capital One. 

  • Never click links in email or text unless you know exactly who it came from. 

  • Stay on top of the latest scams and fraud techniques so you can protect yourself.

  • Sign up for credit and identity theft monitoring to let the experts watch your accounts and notify you of anything suspicious. 

  • Never download software from untrusted sources.

  • Keep all your devices updated with the latest security patches.

  • Install and use good, robust antivirus software.

About the Author
IDStrong Logo

Related Articles

Instagram Vulnerability Allowed Hackers Access to Control Your Phone

Security experts Check Point Research discovered a critical vulnerability while examining Instagram’s c... Read More

Alien Malware Infects More than 226 Mobile Apps and Steals Bank Data

As reported on September 24, 2020, by ZDNet and ThreatPost, a new strain of malware named “Alien” is ... Read More

Universal Health Systems Hit by Ransomware Attack

Universal Health Systems (UHS), a Fortune 500 company owning more than 400 hospitals across the country, ... Read More

Exchange Server Bug Exposes a Big Risk to Hackers

Months after Microsoft released a patch to fix a serious flaw in MS Exchange Server, more than 61% of the... Read More

Scan Your Records for Breaches, Leaks & Exposures!