A former AWS engineer stole 100M Capital One records via a misconfigured firewall

In July 2019, Capital One disclosed that a hacker had accessed the personal data of approximately 100 million customers and applicants — one of the largest data breaches in banking history. The stolen data included names, addresses, credit scores, income information and some Social Security numbers.

The hacker, Paige Thompson, a former AWS engineer, exploited a misconfigured web application firewall (WAF) in Capital One's cloud infrastructure on Amazon Web Services. The misconfiguration allowed Thompson to access internal data stored in AWS cloud storage buckets.

Capital One was fined $80 million by the Office of the Comptroller of the Currency for failing to establish effective risk management. Thompson was arrested and convicted. The case illustrated how cloud migration introduces new security risks that traditional bank security teams may not be equipped to manage, and how a single misconfiguration in a cloud environment can expose data at a scale that on-premises systems would not allow.