Capital One Breach Casts Shadow Over Cloud Security

Massive data exposure highlights sustained risk from poor information-protection practices

Capital was an early adopter cloud computing among Photo: Richard Drew/Associated Press

By Robert McMillan

Updated July 30, 2019 6:57 pm ET

One of the highest-profile hacks of consumer-banking data has sent financial institutions scrambling to figure out how millions of records at one of the biggest proponents of cloud-computing were exposed.
Capital One Financial Corp. COF +1.34% , the fifth-largest U.S. credit-card issuer, said Monday that information of roughly 106 million card customers and applicants was exposed in one of the largest data breaches of a big bank.

The data was stored on Amazon.com Inc. ’s cloud, according to a federal criminal complaint and people familiar with the matter. The avenue of entry, the companies and investigators said, was a poorly configured firewall—a mechanism designed to wall off privately operated digital systems—that a hacker breached.
Both companies say controls around the data, rather than use of the cloud, were the problem. Still, the data was stored in the cloud, raising questions about whether Capital One put insufficient safeguards in place to lock down customer records when it adopted cloud technology. And the accused hacker’s tenure as a former employee of Amazon’s cloud business highlights the risk—previously little appreciated—of an insider threat.
Cloud computing has boomed as companies have increasingly turned to providers such as Amazon and Microsoft Corp. to do the work of configuring computers inside their own data centers. The processing power of those servers and storage devices is then rented out to cloud customers, who pay depending on how much work the computers do.

Data Downers

The Capital One breach joins a list of episodes in recent years.

Capital One was an early adopter of cloud-computing among financial institutions as many other banks hesitated to move customer data out of their data centers. But the global cloud business has expanded—including among banks—as companies such as JPMorgan Chase & Co. and Bank of America Corp. became converts. That has heightened the stakes from the Capital One breach for the broader financial-services and cloud-computing industries.
By 2023, banks globally are forecast to spend more than $53 billion on public cloud infrastructure and data services, up from $24.3 billion this year, according to market research firm International Data Corp.
The disclosure of the breach has caused a behind-the-scenes scramble at several financial institutions to understand what happened at Capital One, according to a person familiar with the discussions.
“Everyone who is migrating to the cloud is really going to look at their controls,” said Sameer Malhotra, the chief executive of TrueFort Inc., a company that provides cloud security services. However, he added, “I don’t think it’s going to change their intention to move to the cloud.”

Capital One started working with Amazon Web Services in 2014 and has since become a... — Capital One started working with Amazon Web Services in 2014 and has since become a marquee customer. Photo: salvador rodriguez/Reuters

Although court documents indicate a Capital One error led to the breach, the alleged hacker, Paige A. Thompson, is a former employee at Amazon’s web services unit, the world’s biggest cloud-computing business. That raises questions about whether she used knowledge acquired while working at the cloud-computing giant to commit her alleged crime, said Chris Vickery director of cyber-risk research at the security firm UpGuard Inc. A lawyer representing Ms. Thompson didn’t return messages seeking comment.
An Amazon spokesman attributed the hack to a firewall issue, not a cloud-computing problem.

Cloud computing caught on in part because it allowed software engineers to sidestep cumbersome security restrictions and sluggish development processes that made companies’ in-house technologies clunky. But the ease and speed of opting instead to fire up a server through Amazon Web Services has led to many cloud misconfiguration problems that can leave sensitive data exposed to unauthorized access.
“It’s easy to misconfigure things and it’s easy to have catastrophic results from those misconfigurations,” Mr. Vickery said.
As the list of companies that have inadvertently exposed data on the cloud has grown, Amazon has taken steps to minimize that risk. In 2017, the company introduced a series of technologies to detect such configuration problems and make them easier to fix.
Capital One started working with AWS in 2014 and has since become a marquee customer. In 2015, Capital One Chief Information Officer Rob Alexander said “the financial services industry attracts some of the worst cybercriminals. So we worked closely with the Amazon team to develop a security model, which we believe enables us to operate more securely in the public cloud than we can even in our own data centers.”
“This type of vulnerability is not specific to the cloud,” Capital One said of the hack. “The elements of infrastructure involved are common to both cloud and on-premises data center environments.” The bank added that its use of the cloud helped it respond to the breach faster. The company learned of the incident on July 19 and notified affected customers 10 days later.
Over the years, Capital One has developed systems to prevent data from being inadvertently released to the wider internet, according to a person familiar with the company’s operations.
“Any company that has or is looking to move into the cloud must ensure that their security strategy is developed alongside of that transformation,” said Vincent Liu, a partner with the security-consulting firm Bishop Fox.
Mr. Liu, whose company assesses security vulnerabilities on corporate networks, says that while configuration problems happen in corporate data centers as well, he often finds that “basic cyber hygiene gets thrown out the window” as companies move to new technologies such as the cloud.
The financial stakes for companies to safeguard customer information are quickly rising. Credit-reporting company Equifax Inc. struck a $700 million settlement this month with state and federal authorities concerning its 2017 data breach that exposed information on some 150 million Americans. In Britain, Marriott International Inc. faces a potential £99.2 million ($102.5 million) fine over a data breach. The same U.K. regulator this month also proposed a record £183.4 million fine following a hack at British Airways last year.
Capital One said it expected to spend up to $150 million to cover breach-related costs, largely for issues such as notifying customers and paying for credit monitoring. The bank didn’t discuss potential fines.
Write to Robert McMillan at Robert.Mcmillan@wsj.com

Appeared in the July 31, 2019, print edition as 'Hack Casts a Shadow on Cloud Security.'

Most Popular Articles

WSJ opens select articles to reader conversation to promote thoughtful dialogue. See the 'Join the Conversation' area to the right for stories open to conversation. For more information, please reference our community guidelines. Email feedback and questions to moderator@wsj.com.