2019 · Banking

Capital One, 2019: a firewall misconfiguration and 106 million applicants

Case file · 4 min read · Published 14 September 2026

People affected: about 100 million US and 6 million Canadian applicants
When it happened: March 2019
Made public: 29 July 2019
How they got in: Server-side request forgery through a misconfigured web application firewall, reaching cloud instance metadata
Attributed to: Paige Thompson, a former cloud engineer, convicted in 2022
What it cost: $80 million regulatory penalty and a $190 million class settlement

What was exposed: Names · Addresses · Phone numbers · Email addresses · Dates of birth · Self-reported income · Credit scores and balances · 140,000 Social Security numbers · 80,000 linked bank account numbers · 1 million Canadian Social Insurance numbers

Capital One's breach is the best worked example of a cloud-native intrusion, and the part everyone remembers is wrong. The attacker did not break Amazon's cloud. She asked a misconfigured firewall to fetch a URL for her, and the URL she chose was the one where the machine keeps its own keys.

What happened

In March 2019, an attacker exploited a misconfiguration in a web application firewall that Capital One ran on a cloud instance. The flaw allowed server-side request forgery: the ability to make the server issue an HTTP request to an address of the attacker's choosing.

From outside, a browser cannot reach the cloud's internal metadata address. From the instance itself, it can — and that address returns temporary credentials for the role attached to the machine. The attacker retrieved those credentials, found that the role could list and read storage buckets, and copied out the contents.

What was in them: credit card applications submitted between 2005 and early 2019, covering roughly 100 million people in the United States and 6 million in Canada. Names, addresses, dates of birth, self-reported income, credit scores and balances. Around 140,000 Social Security numbers, 80,000 linked bank account numbers and a million Canadian Social Insurance numbers.

The chain, in four links. A firewall configured to allow an outbound request it should have refused. A metadata service that answers any request from the instance without further proof. A role with far more storage permission than the workload needed. And no alert on a sudden bulk listing and download of buckets. Remove any one of the four and the breach does not happen at this scale. That is the honest way to read most cloud incidents: not one catastrophic hole, but four ordinary settings lined up.

How it was discovered

Not by monitoring. On 17 July 2019, an outside researcher emailed Capital One's responsible disclosure address to report that data appearing to belong to the bank had been published on a public code-sharing site. The attacker had also discussed the material in online chat groups under a recognisable handle. Capital One confirmed the breach, notified the FBI, and an arrest followed on 29 July — the same day the breach was announced publicly.

Four months from intrusion to discovery, and the discovery came from someone who happened to notice a public post. It is worth sitting with that: the technical sophistication of the attack was modest, and the detection was accidental.

The timeline

March 2019 — The SSRF is exploited; credentials are retrieved and data copied from storage.
April–June 2019 — Evidence of the data is posted publicly and discussed in online groups.
17 July 2019 — An outside researcher emails Capital One's disclosure address.
19 July 2019 — Capital One confirms the breach and contacts the FBI.
29 July 2019 — Public disclosure; Paige Thompson is arrested.
November 2019 — Amazon releases Instance Metadata Service v2, which requires a session token and blocks the SSRF path used here.
August 2020 — The Office of the Comptroller of the Currency fines Capital One $80 million for failures in risk assessment and internal controls around its cloud migration.
December 2021 — A $190 million class-action settlement is agreed.
June and October 2022 — Thompson is convicted and sentenced.

What it changed

Cloud metadata got a second version. IMDSv2 requires a client to obtain a session token with a PUT request before reading credentials, and restricts network hops. SSRF alone no longer suffices. It is one of the clearest cases of a single breach changing a piece of global cloud infrastructure.

Regulators started auditing cloud migrations specifically. The OCC's penalty was not for being breached; it was for inadequate risk assessment and control design when moving significant operations to the cloud, and for internal audit failing to identify the weaknesses. Since 2020, "did you assess the risk before you migrated?" is a standard examination question for regulated firms.

Over-permissive roles became the headline cloud risk. The instance role could read far more than the application needed. Least privilege had been a slogan for decades; this case made it a board-level finding, and it is why permission-boundary tooling became a product category.

What makes this case unusual

Most large breaches end with attribution to a group that will never be prosecuted. This one ended with an arrest within days, a trial, and a conviction — because the attacker discussed it publicly under a traceable handle. It is a reminder that the population of people attacking systems includes individuals acting alone with poor operational security, not only organised crews and state units.

If you applied for a Capital One card before 2019

An application you were rejected for still counts. The data covers applicants, not just customers, which is what makes the population so much larger than the cardholder base.
Freeze your credit files. For the 140,000 people whose Social Security numbers were taken, this is the specific control that blocks new accounts being opened.
Watch for precision phishing. Self-reported income and credit balance data makes a fraudulent "your account needs verification" message far more persuasive — the signals that still give those messages away.
Canadian applicants: your SIN is in the file. Contact the credit bureaus for a fraud alert, and treat unexpected contact about credit as suspect.

Questions people ask

What is SSRF, in plain terms?

Server-side request forgery. You persuade a server to make a web request on your behalf — to an address you choose. That matters because the server sits inside the network and can reach internal addresses your browser cannot, including, in a cloud environment, the special address that hands out the machine's own credentials.

Why did the cloud hand over credentials?

Cloud instances fetch temporary credentials from a link-local metadata address so applications do not need hard-coded keys. It is a good design with one weakness: any code that can make an HTTP request from the instance can ask for those credentials. If the request can be triggered from outside through SSRF, so can the credential theft. Amazon's IMDSv2, released months after this breach, requires a session token first, which closes that path.

Was Capital One hacked because it used the cloud?

No. The misconfiguration was Capital One's, in a firewall it operated, and the same mistake is possible in a data centre. What the cloud changed is the blast radius: an over-permissive role attached to one instance could list and copy entire storage buckets in minutes.

What happened to the attacker?

Paige Thompson, a former Amazon Web Services engineer, was arrested in July 2019 after discussing the data online and publishing evidence of it to a public code-sharing site. She was convicted of wire fraud and computer fraud in June 2022 and sentenced to time served with five years of probation.

Sources

Office of the Comptroller of the Currency — $80 million civil money penalty against Capital One, August 2020
US Department of Justice — indictment and conviction of Paige Thompson, 2019–2022
Capital One incident disclosures and SEC filings, 2019
Amazon Web Services — announcement of Instance Metadata Service v2, November 2019