Capital One Breach

The Threat

On July 29th, 2019, Capital One Financial Corporation announced that an unauthorized actor had gained access to the Capital One network and successfully exfiltrated a variety of customer information [1]. The attacks occurred between March 12th and July 17th, 2019. Exfiltrated information includes Capital One client names, addresses, phone numbers, postal codes, email addresses, DOB, and self-reported income, along with 1 million Social Insurance numbers, 140,000 Social Security numbers and 80,000 bank account numbers. In total, approximately 106 million Capital One credit card users and applicants are affected.

An arrest has been made in relation to this attack, and Capital One purports that the stolen information was not used for fraud or disseminated by the accused [2].

What we're doing about it

• Detection methods for this attack are being investigated
• The Threat Intelligence team is monitoring this topic for additional information

What you should do about it

• Capital One customers are recommended to proactively review account information and register for free credit monitoring & identity protection if applicable
• While reports indicate that no log-in credentials were compromised, out of an abundance of caution, consider changing all passwords associated to Capital One bank accounts
• Avoid releasing personal information over the phone. The Wall Street journal reports that Capital One indicates they are not calling customers about this incident.

Additional information

Capital One became aware of the breach after an email tip from an unidentified individual. This attack was made possible due to a misconfiguration in the Capital One’s Web Application Firewall (WAF). The threat actor was able to exploit the misconfiguration to circumvent access controls. Current reporting indicates that stolen information was initially dumped on GitHub.

Capital One is in the process of notifying affected individuals and is offering free credit monitoring and identity protection to those affected by the breach.

References:

[1] https://www.capitalone.com/facts2019/

[2] https://www.justice.gov/usao-wdwa/press-release/file/1188626/download