A misconfigured firewall exposed 100 million Capital One records

What happened

According to the Department of Justice's case record, the intrusion into Capital One's cloud-hosted data occurred through a misconfigured web application firewall that enabled access to the data. A GitHub user alerted Capital One to a posting describing the exposure on 17 July 2019, and the company says it determined two days later, on 19 July 2019, that an outside individual had gained unauthorized access to credit-card application and account data covering roughly 100 million people in the United States and six million in Canada. Capital One's own account states no card numbers or log-in credentials were exposed. The former technology worker accused of the intrusion, Paige Thompson, was traced through the GitHub posting, arrested, and later convicted by a federal jury in 2022 of wire fraud and computer intrusions; a later appeals court ruling found her original sentence too lenient and, on resentencing, upheld a restitution order of 40.7 million dollars. The Office of the Comptroller of the Currency separately found that Capital One failed to establish effective risk-assessment processes before migrating significant technology operations to the public cloud, and fined its bank subsidiaries 80 million dollars.

Confidence and limits

The DOJ's own case description and the OCC's consent order agree on the mechanism: a public-facing firewall flaw combined with a cloud role that had more access than the application needed. Those documents establish the regulatory and criminal record; they do not themselves total the eventual sentence, which changed on appeal. For that later detail, this account relies on a single reputable news account, since the department's own press-release pages describing the conviction and sentencing were not retrievable when checked.

Why it mattered

The case became a reference point for what shared responsibility means in practice: a cloud provider secures the infrastructure, but a customer that misconfigures its own firewall or over-grants a role still owns the resulting exposure. The OCC's order made that a supervisory expectation, penalising the bank specifically for its pre-migration risk assessment rather than for the intrusion technique alone.

Defensive takeaway

Review whether any internet-facing application can reach a cloud metadata service or an identity role broader than it needs, and confirm a risk assessment was actually completed, not just planned, before a workload moved to the cloud.

• Can a public-facing application on our network reach cloud credentials or a metadata endpoint it does not need?
• Would we detect a large, unusual data transfer out of a cloud storage account before it was posted publicly?
• Did we complete a documented risk assessment before, not after, migrating a given workload to the cloud?

Capital One's case is now closed as a matter of regulatory and criminal record, but the pattern, a permissive cloud role reachable through a public application flaw, recurs across many later cloud incidents, which is why the shared-responsibility lesson outlived the specific vulnerability that exposed it.