Capital One Data Breach (2019)

Executive Summary

In July 2019, Capital One Financial Corporation formally disclosed one of the most significant data breaches in the history of the financial services sector. The security incident resulted in the unauthorized exposure of personal and financial information for approximately 100 million individuals in the United States and 6 million individuals in Canada. The compromised dataset primarily consisted of consumer and small business credit card application data collected between 2005 and early 2019.

The intrusion was executed by Paige A. Thompson, a 33-year-old former Amazon Web Services (AWS) software engineer operating under the pseudonyms "erratic" and "netcrave". Leveraging custom scanning scripts, Thompson identified a misconfigured open-source ModSecurity Web Application Firewall (WAF) within Capital One’s AWS Elastic Compute Cloud (EC2) environment. She exploited a Server-Side Request Forgery (SSRF) vulnerability to coerce the WAF into querying the internal AWS Instance Metadata Service (IMDSv1) at 169.254.169.254, successfully extracting temporary credentials for an overly permissive Identity and Access Management (IAM) role.

Utilizing these stolen credentials, Thompson enumerated over 700 Simple Storage Service (S3) buckets and synchronized approximately 30 gigabytes of data to her local machine via the AWS Command Line Interface (CLI). The breach exposed severe corporate governance failures regarding cloud risk assessments and internal audit escalations, ultimately resulting in an $80 million civil penalty from the Office of the Comptroller of the Currency (OCC), a $190 million consumer class-action settlement, and Thompson's federal criminal conviction. Strategically, the incident forced a global industry shift in cloud architecture, directly catalyzing AWS's development and deployment of the token-based Instance Metadata Service Version 2 (IMDSv2).

Verification of Claims

1. Claim: The breach resulted in the compromise of data belonging to approximately 106 million individuals, including the theft of U.S. Social Security Numbers and Canadian Social Insurance Numbers. → Verified → Corroborated by Capital One's official corporate disclosures, SEC Form 8-K filings, the DOJ criminal complaint, and the $190 million class-action settlement.

2. Claim: The attacker leveraged an SSRF vulnerability against a misconfigured WAF to extract credentials from the AWS Instance Metadata Service (IMDS). → Verified → The exploitation chain is explicitly documented in DOJ forensic reports, the OCC's Cease and Desist Order, and exhaustive technical post-mortems conducted by independent cloud security entities.

3. Claim: The attacker bypassed Amazon Web Services' core infrastructure security, indicating a flaw in AWS's fundamental hypervisor or hardware architecture. → Unverified / Refuted → Multiple sources and independent researchers confirm the underlying AWS infrastructure operated as designed; liability resided with Capital One's configuration of the guest OS, WAF application layer, and excessive IAM permissions under the AWS Shared Responsibility Model.

4. Claim: The threat actor actively monetized the stolen data by selling it to organized cybercrime syndicates on the dark web or utilizing it for direct financial fraud. → Unverified → Federal investigators and Capital One publicly stated there is no forensic evidence suggesting the data was sold, shared for fraud, or distributed to third parties prior to the attacker's arrest.

5. Claim: The vulnerability was identified and reported to Capital One by a third-party security researcher prior to internal detection systems identifying the exfiltration. → Verified → DOJ records confirm the intrusion remained undetected by Capital One's internal SOC until July 17, 2019, when an external GitHub user observed the attacker bragging about the exploit and submitted a responsible disclosure tip.

Timeline

Attack Anatomy

Initial Access: Using custom scanning tools, the attacker identified a Capital One open-source ModSecurity Web Application Firewall (WAF) deployed on an AWS EC2 instance in a public subnet. The attacker exploited a Server-Side Request Forgery (SSRF) vulnerability within the WAF, bypassing traditional perimeter security boundaries.

Execution: The attacker crafted HTTP requests that forced the misconfigured WAF to act as a confused deputy, generating an outbound call to http://169.254.169.254/latest/meta-data/iam/security-credentials/. This queried the link-local AWS EC2 Instance Metadata Service (IMDSv1), which at the time required no authentication.

Privilege Escalation: The IMDS endpoint returned the name of the IAM role attached to the EC2 instance (ISRM-WAF-Role). A subsequent SSRF request extracted the temporary AWS API credentials (AccessKeyId, SecretAccessKey, and Token) associated with that role. This role violated the Principle of Least Privilege, as it possessed broad s3:GetObject and s3:ListBucket permissions across all resources instead of being scoped exclusively to WAF logging buckets.

Lateral Movement: The attacker configured the stolen credentials locally and authenticated to the AWS Command Line Interface (CLI). Using the aws s3 ls command, she enumerated over 700 S3 buckets associated with the compromised Capital One AWS account to locate sensitive credit application data.

Collection: The attacker identified the specific S3 buckets storing massive repositories of consumer PII, including names, dates of birth, incomes, and fragmented transaction histories.

Exfiltration: Routing traffic through anonymizing services such as the TOR network and IPredator VPN, the attacker utilized the aws s3 sync command to recursively copy and download approximately 30 gigabytes of unencrypted, sensitive consumer data directly to her local machine.

Impact: The exfiltration resulted in the compromise of 106 million consumer records across the U.S. and Canada, precipitating severe regulatory fines, a massive class-action settlement, and federal criminal convictions.

Threat Actor Profile

• Name / Alias: Paige A. Thompson (aliases "erratic", "netcrave", "@0xa3a97b6c", "paigeaselethompson2019")

• Attribution Confidence: High — The evidence basis is absolute; investigators traced digital footprints across GitHub, GitLab, and Slack directly to Thompson, seized physical devices containing the stolen data at her residence, and secured a federal jury conviction.

• Motivation: Financial / Notoriety / Disruption — Thompson possessed financial motives related to cryptojacking, alongside a strong psychological desire for notoriety and recognition, frequently boasting about her exploits on public hacker forums.

• Sophistication Level: Advanced — As a former AWS systems engineer, Thompson possessed an expert-level understanding of cloud infrastructure, metadata services, and the AWS command-line interface, successfully authoring custom automation scripts to chain WAF misconfigurations with IMDS vulnerabilities.

• Known Previous Operations: Thompson hacked into the cloud environments of more than 30 other entities, including a state government agency and a public research university, primarily to establish persistent infrastructure for cryptocurrency mining.

• Nation-State Nexus: No — Thompson operated entirely as a lone-wolf domestic actor residing in Seattle, Washington, with no evidence of state-sponsored affiliation.

• MITRE ATT&CK Techniques:

  • T1190 — Exploit Public-Facing Application
  • T1552.005 — Unsecured Credentials: Cloud Instance Metadata API
  • T1078.004 — Valid Accounts: Cloud Accounts
  • T1046 — Network Service Discovery
  • T1530 — Data from Cloud Storage Object
  • T1048 — Exfiltration Over Alternative Protocol
  • T1567 — Exfiltration Over Web Service
  • T1090.003 — Proxy: Multi-hop Proxy

• Operational Security (OpSec): Poor — Thompson posted specific details of the breach (including IP addresses, commands, and target details) on her personal GitHub and GitLab pages using identifiable aliases, boasted on public Slack channels, and failed to encrypt or delete the stolen data on her seized personal workstation.

Technical Indicators

domains:
  - "gitlab[.]com"
  - "github[.]com"
ip_addresses:
  - "169.254.169[.]254"
file_hashes: []
urls:
  - "hxxp://169.254.169[.]254/latest/meta-data/iam/security-credentials/"
  - "hxxps://gitlab[.]com/netcrave"
  - "hxxps://gist[.]github[.]com/paigeadelethompson"
  - "hxxps://github[.]com/erratic"
  - "hxxps://github[.]com/Netcrave"
c2_infrastructure:
  - "AWS EC2 Instance Metadata Service (IMDS) at 169.254.169.254"
  - "Capital One S3 buckets (700+ compromised)"

Legal and Regulatory Response

Law Enforcement Actions

Following a responsible disclosure tip on July 17, 2019, FBI cyber investigators rapidly traced the digital footprints to Paige Thompson. On July 29, 2019, federal agents executed a search warrant at Thompson’s residence in Seattle, Washington, arresting her on-site and seizing multiple electronic storage devices containing the exact 30 GB dataset stolen from Capital One.

Government Directives

On August 6, 2020, the Office of the Comptroller of the Currency (OCC) issued a formal Cease and Desist Order (Consent Order 2020-054) levying an $80 million civil penalty for failing to establish effective risk assessment processes prior to cloud migration. Simultaneously, the Federal Reserve Board issued a separate cease-and-desist order mandating a comprehensive overhaul of Capital One's cybersecurity posture and board reporting processes. Both orders were terminated between 2022 and 2023 after successful remediation.

Platform Response

Capital One immediately patched the SSRF vulnerability in the WAF, closed compromised access points, and initiated public breach notifications. AWS maintained that its systems functioned as designed under the Shared Responsibility Model, but subsequently engineered and released Instance Metadata Service Version 2 (IMDSv2) in November 2019. IMDSv2 neutralizes the SSRF attack vector by requiring token-based session authentication (an HTTP PUT request) and rejecting requests with a network hop count greater than one.

Criminal Proceedings

Thompson was indicted in August 2019 by a federal grand jury on charges of wire fraud and computer fraud and abuse (CFAA). In June 2022, a federal jury convicted her on seven counts. In October 2022, the presiding U.S. District Court judge sentenced Thompson to time served combined with five years of probation due to mental health circumstances. In March 2025, the Ninth Circuit Court of Appeals (Case 22-30179) ruled the probation-only sentence was excessively lenient and remanded the case back to the district court for resentencing.

Impact Assessment

• Total Individuals Affected: Confirmed: Approximately 106 million people (100 million in the U.S. and 6 million in Canada).
• U.S. Social Security Numbers Compromised: Confirmed: Approximately 144,700 (140,000 discovered initially, with an additional 4,700 discovered via ongoing forensics in January 2021).
• Canadian Social Insurance Numbers Compromised: Confirmed: Approximately 1 million.
• Linked Bank Account Numbers Compromised: Confirmed: Approximately 80,000.
• Credit Card Account Numbers and Login Credentials: Confirmed: None compromised.
• Civil Litigation and Settlement Costs: Confirmed: $190 million utilized to fund a consumer class-action settlement.
• Regulatory Penalties: Confirmed: $80 million civil monetary penalty paid to the OCC.
• Total Estimated Financial Cost: Estimated: Over $270 million in fines and settlements (excluding remediation and legal fees).
• Market and Reputational Consequences: Reported: Capital One’s stock price plunged 5.9% immediately following the public disclosure, eventually losing up to 15% of its market capitalization over the subsequent two weeks.

Lessons and Defensive Recommendations

For Security Teams / SOC Analysts: Security Operations Centers must ingest and aggressively monitor AWS CloudTrail logs, configuring immediate alerts when an EC2 instance profile assumes a role and initiates high-volume enumeration (e.g., s3:ListAllMyBuckets) or bulk download (s3:GetObject) requests that deviate from historical baselines. Establish strict geofencing and IP monitoring for API calls, automatically revoking access keys if commands originate from TOR exit nodes or commercial VPN providers. Continuously audit WAF and reverse proxy routing rules, explicitly denying outbound traffic destined for cloud metadata IP addresses (169.254.169.254) unless tightly scoped.

For Developers and Architects: Eradicate SSRF vulnerabilities by never implicitly trusting user-supplied input for outbound web requests, implementing robust URL parsing, and enforcing DNS resolution checks to ensure hostnames do not resolve to local, loopback, or metadata IP ranges. Enforce IMDSv2 fleet-wide, transitioning all legacy workloads away from IMDSv1 to neutralize standard SSRF exploitation techniques. Enforce strict Least Privilege for all IAM roles; a WAF requires permissions to read configurations and write logs, not to recursively read customer data from hundreds of S3 buckets.

For Platform / Cloud Providers: Cloud infrastructure must be shipped secure by design, enforcing mechanisms like IMDSv2 by default for all new compute instances to shift foundational architecture security burdens from the customer to the provider. Natively provide Cloud Security Posture Management (CSPM) alerts when highly sensitive S3 buckets are accessible by roles with unusually broad permissions, or when compute instances exhibit characteristics of an open reverse proxy.

For Leadership / CISO: Executive leadership must sponsor comprehensive, independent cloud-specific risk assessments prior to large-scale data migrations, recognizing that the shared responsibility model introduces existential legal liabilities if misunderstood. Corporate governance must empower internal audit functions to operate with absolute independence, ensuring critical security misconfigurations bypass internal bureaucracy and escalate directly to the Board of Directors. Adopt a Zero Trust philosophy, acknowledging that identity—not the corporate network perimeter—is the true security boundary in modern cloud environments.

Sources

1. Security.org. "Capital One Data Breach: What Happened and What to Do". July 8, 2026.
2. Capital One. "2019 Capital One Cyber Incident | What Happened". August 12, 2026.
3. OCC. "OCC Assesses $80 Million Civil Money Penalty Against Capital One". August 6, 2020.
4. Bloomberg. "Capital One Settles Class-Action Cyber Lawsuit for $190 Million". December 23, 2021.
5. New York Times. "Capital One settles a class-action lawsuit for $190 million in a 2019 hacking". December 23, 2021.
6. Banking Dive. "OCC frees Capital One from consent order tied to 2019 breach". September 19, 2022.
7. Compliance Concourse (Willkie Farr & Gallagher). "OCC fines Capital One $80 million for cloud security violations". January 11, 2023.
8. Huntress. "Capital One Data Breach: What Happened, Impact, and Lessons". November 21, 2025.
9. Data Breach Cost. "Capital One 2019: $300M+, the cloud-misconfiguration precedent". May 16, 2026.
10. Forensic Legibility. "Case 087: Cloud Infrastructure Access Authority Failure".
11. Cloud Defender Blog. "Capital One 2019: How a Single Misconfigured IAM Role Exposed 106M Records". June 25, 2026.
12. CSOH. "Capital One 2019 Breach Kill Chain". 2019.
13. Cloudskope. "Capital One Breach 2019: 106M Records". July 1, 2019.
14. Corporate Vault. "Capital One: The $190 Million 'Inside' Cyber-Breach". May 16, 2026.
15. Tech Earl. "Capital One Breach: SSRF and the AWS Metadata Service". June 13, 2026.
16. DOJ. "Former hacker sentenced for stealing computer power to mine cryptocurrency and stealing data". October 4, 2022.
17. DOJ. "Former Seattle tech worker convicted of wire fraud and computer intrusions". June 17, 2022.
18. CNBC. "Former Amazon employee convicted in Capital One hack". June 18, 2022.
19. MIT CAMS. "A Case Study of the Capital One Data Breach".
20. Seattle Times. "Ex-Amazon worker convicted in massive Capital One hack". June 17, 2022.
21. TechCrunch. "Ex-Amazon employee convicted over data breach of 100 million CapitalOne customers". June 21, 2022.
22. BBC. "Capital One data breach: Arrest after details of 106m people stolen". July 30, 2019.
23. Business Insider. "Ex-Amazon employee convicted of hacking Capital One and stealing data of over 100 million people". June 2022.
24. SiliconANGLE. "Former AWS employee given 5 years probation for Capital One hack". October 5, 2022.
25. Investopedia. "Capital One Data Breach Impacts 106 Million Customers". July 2019.
26. NY Post. "Jury convicts Seattle woman in massive Capital One hack". June 18, 2022.
27. Federal Reserve. "Federal Reserve Board issues enforcement action with Capital One". August 6, 2020.
28. DOJ. "Seattle Tech Worker Arrested for Data Theft Involving Large Financial Services Company". July 29, 2019.
29. DOJ. "Former Seattle Tech Worker Indicted on Federal Charges for Wire Fraud and Computer Data Theft". August 28, 2019.
30. LA Times. "Tipster's email led to arrest in massive Capital One breach". July 30, 2019.
31. CNN. "What we know about Paige Thompson, the alleged Capital One hacker". July 30, 2019.
32. Nasdaq. "Regulators Hit Capital One With $80 Million Fine, Cease and Desist Orders". August 6, 2020.
33. CNN. "Bank regulators crack down on Capital One after its massive data breach". August 6, 2020.
34. MIT DSpace. "A Systematic Analysis of the Capital One Data Breach".
35. Harvard Corporate Governance. "What the Capital One Hack Means for Boards of Directors". August 17, 2019.
36. SecureWorld. "8 Cybersecurity Facts Revealed About the Capital One Cloud Hack Breach". July 31, 2019.
37. Fox Business. "Who is Paige Thompson? Alleged Capital One hacker went by alias 'erratic'". July 30, 2019.

Corrections log — 1 September 2026: The timeline recorded the Ninth Circuit's March 2025 reversal but stopped there, leaving the case's disposition open. The post-remand resentencing outcome has been added: time served was reimposed with three years of home confinement, 250 hours of community service, and the $40.7 million restitution order maintained.