U.S. v. Paige Thompson (Capital One Cloud Breach)
Key Facts
- Legal Status: CONVICTED in U.S. District Court for the Western District of Washington.
- Primary Target Sector: Financial Services, Cloud Computing.
- Documented Financial Loss: $270.0 million.
- 4 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Former Seattle cloud engineer who identified misconfigured web application firewalls to gain unauthorized access to Capital One's Amazon Web Services storage buckets, exfiltrating 106 million customer credit card applications.
Root Cause & Infiltration Vector
Server-Side Request Forgery (SSRF) flaw in a misconfigured open-source ModSecurity Web Application Firewall (WAF) hosted on an Amazon Web Services EC2 instance.
Operational Impact & Financial Blast Radius
Over 100 million credit card applications, 140,000 Social Security numbers, and 80,000 linked bank account numbers exfiltrated from 700 Amazon S3 storage buckets. Capital One paid an $80 million regulatory fine and a $190 million class action settlement.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Thompson sent crafted HTTP requests to the misconfigured WAF, tricking it into querying the AWS local metadata service (169.254.169.254) and returning temporary security credentials for an IAM role.
The stolen IAM role (*PRIV_WA_SCAN*) possessed excessive permissions allowing the attacker to list and read all files across Capital One's Amazon S3 object storage environment.
Using high-speed multithreaded cloud CLI scripts, Thompson downloaded over 700 buckets containing 100M+ customer applications to her personal server, then discussed the breach on Slack and posted scripts to GitHub.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
FBI agents arrest Thompson at her residence in Seattle.
Federal grand jury indicts Thompson on wire fraud and seven counts of computer intrusion.
Jury finds Thompson guilty of wire fraud and six counts of unauthorized access to a protected computer.
Sentenced to time served and five years of supervised release with restitution ordered.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Paige Adele Thompson | United States | convicted | Pending | None | Perpetrator of Capital One cloud data breach; convicted of wire fraud and computer intrusion. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1190 | Exploit Public-Facing Application Initial Access | "Thompson sent crafted HTTP requests exploiting a Server-Side Request Forgery (SSRF) flaw in a misconfigured open-source ModSecurity WAF." | Indictment ¶ 9, Page 4 | reviewed |
| T1078 | Valid Accounts Defense Evasion | "Obtained temporary security credentials from the AWS EC2 instance metadata service to access private S3 storage buckets." | Trial Transcript Day 3, Page 54 | reviewed |
| T1567 | Exfiltration Over Web Service Exfiltration | "Using multithreaded cloud CLI commands, the defendant downloaded over 700 S3 buckets containing approximately 100 million credit card applications, Social Security numbers, and bank account details." | Indictment ¶ 11, Page 5 | reviewed |
| T1083 | File and Directory Discovery Discovery | "Thompson ran automated aws-s3 listing commands to enumerate bucket contents across victim customer directories." | Indictment ¶ 12, Page 6 | reviewed |