HN Explorer

Some thoughts on Capital One data breach

2 points by danTheFounder ↗ HN
Capital One was hacked by a software engineer. Once again, S3 bucket got hacked because of one misconfiguration. And it contains millions of people's personal information and credit history. Some thoughts on what happened to Capital one (3rd Credit Card issuer in the world) - If one misconfiguration can lead to massive data breach (including encrypted data), and it happens again and again, this cloud provider probably needs to improve its security design. - Security is hard and it's even harder in the cloud. But can you ask more often "What Could Go Wrong" if your job is to defend millions of people's credit card information.

(FBI report: https://www.justice.gov/usao-wdwa/press-release/file/1188626/download)

1 comment

[ 3.2 ms ] story [ 16.8 ms ] thread
danTheFounder
Here are the pages of the report that make me upset: - Page 6, paragraph 10 : "A firewall misconfiguration permitted commands to reach and be executed by that server, which enabled access to folders or buckets of data in Capital One's storage space at the Cloud Computing Company" - Page 8, paragraph 14: "According to Capital One, the data copied from Capital One's data folders or buckets includes primarily data related to credit card applications. Although some of the information in those applications (such as SSN) has been tokenized or encrypted, other information including applicants' names, addresses, dates of birth and information regarding their credit history has not been tokenized. According to Capital One, the data includes data regarding large numbers of applications, likely tens of millions of applications. According to Capital One that dta includes approximately 120,000 SSN and approximately 77,000 bank account numbers.