Capital One Breach: 100 Million Credit Card Application Compromised

Popular credit card business and Virginia-based bank Capital One announced a hacker accessed 100 million customer credit card applications. According to investigators, customer names, dates of birth, addresses and credit histories became exposed as a direct result. 

While tokenization did protect customers’ credit card numbers and login credentials, 140,000 Social Security numbers became compromised; additionally, the hacker also accessed approximately 77,000 bank account numbers. 

Surprisingly, authorities identified and apprehended a suspect in connection to the Capital One Breach. Indeed, Paige A. Thompson, an employee at a third-party cloud provider, allegedly boasted of her criminal activities online. Not only did this lead authorities to discover the breach, but it led to her arrest. Unfortunately, evidence suggests she conducted her breach over a period of several months without detection. 

Given the remoteness and anonymity of hackers, actual arrests for data breaches prove incredibly rare. For example, the hackers behind the Equifax breach, one of the most substantial in history, have never been identified.    

What the Capital One Breach Means For Your Enterprise

The fallout from the Capital One Breach remains ambiguous at this time. Certainly, the bank may have to pay a fine in excess of $100 million in the short-term. Also, their customers may have to contend with phishing attacks for years to come. 

However, enterprises can learn positive lessons from this breach for their own cybersecurity. For example, this breach shows the effectiveness of tokenization in mitigating the damage of a long-term breach. Even though the hacker allegedly dwelt on the network for over a decade, they could not gain access to the tokenized data. This should serve as your enterprise’s wakeup call.  

As another example, your threat intelligence should include unconventional sources as well as more traditional ones. You never know when a random forum post may become relevant to your enterprise. 

Finally, always watch third-party behaviors and access to your network. Leaving unmonitored can open the door to the unscrupulous. 

To help protect your enterprise, get started with our Identity Management Buyer’s Guide. In it, we explore the top vendors and their key capabilities.

Editor’s Note: We previously stated the breach took place over a period of 14 years; instead, the information breached came from about 14 years of credit card applications. The breach itself took place over the course of a few months before discovery. 

Widget not in any sidebars