Capital One Financial Corp. said data from about 100 million people in the U.S. was illegally accessed after prosecutors accused a Seattle woman identified by Amazon.com Inc. as one of its former cloud service employees of breaking into the bank’s server.
While the complaint doesn’t identify the cloud provider that stored the allegedly stolen data, the charging papers mention information stored in S3, a reference to Simple Storage Service, Amazon Web Services’ popular data storage software.
An AWS spokesman confirmed that the company’s cloud had stored the Capitol One data that was stolen, and said it wasn’t accessed through a breach or vulnerability in AWS systems. Prosecutors alleged that the access to the bank data came through a misconfigured firewall protecting one of its applications.
Paige A. Thompson was arrested Monday and appeared in federal court in Seattle. The data theft occurred some time between March 12 and July 17, U.S. prosecutors in Seattle said.
Thompson was previously an Amazon Web Services employee. She last worked at Amazon in 2016, spokesman Grant Milne said. The breach described by Capitol One didn’t require insider knowledge, he said.
“I am deeply sorry for what has happened,” Richard D. Fairbank, Capital One’s chief executive officer, said in a statement. “I sincerely apologize for the understandable worry this incident must be causing those affected.”
About 6 million individuals in Canada were also impacted by the breach, Capital One said.
The largest category of data stolen was supplied by consumers and small businesses when they applied for credit cards from 2005 through early 2019, the bank said. It included a wide array of personal data, such as names, addresses, phone numbers, dates of birth, self-reported income, credit scores and fragments of transaction history.
About 140,000 Social Security numbers were accessed, as well as 80,000 bank account numbers from credit-card customers, the bank said.
Capital One shares fell as much as 6.5% Tuesday morning, their biggest decline in six months.