Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Protect assets from ransomware, trojans, rootkits and more.
Intelligence and visibility across AWS, O365, DevOps and more.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
The Threat
On July 29th, 2019, Capital One Financial Corporation announced that an unauthorized actor had gained access to the Capital One network and successfully exfiltrated a variety of customer information [1]. The attacks occurred between March 12th and July 17th, 2019. Exfiltrated information includes Capital One client names, addresses, phone numbers, postal codes, email addresses, DOB, and self-reported income, along with 1 million Social Insurance numbers, 140,000 Social Security numbers and 80,000 bank account numbers. In total, approximately 106 million Capital One credit card users and applicants are affected.
An arrest has been made in relation to this attack, and Capital One purports that the stolen information was not used for fraud or disseminated by the accused [2].
What we're doing about it
Detection methods for this attack are being investigated
The Threat Intelligence team is monitoring this topic for additional information
What you should do about it
Additional information
Capital One became aware of the breach after an email tip from an unidentified individual. This attack was made possible due to a misconfiguration in the Capital One’s Web Application Firewall (WAF). The threat actor was able to exploit the misconfiguration to circumvent access controls. Current reporting indicates that stolen information was initially dumped on GitHub.
Capital One is in the process of notifying affected individuals and is offering free credit monitoring and identity protection to those affected by the breach.
References:
[1] https://www.capitalone.com/facts2019/
[2] https://www.justice.gov/usao-wdwa/press-release/file/1188626/download
[3] https://www.wsj.com/articles/the-capital-one-breach-what-it-means-for-you-11564500086
References:
[1] https://www.capitalone.com/facts2019/
[2] https://www.justice.gov/usao-wdwa/press-release/file/1188626/download
[3] https://www.wsj.com/articles/the-capital-one-breach-what-it-means-for-you-11564500086