{
  "id": "case-paige-thompson-capitalone",
  "slug": "us-v-thompson-capital-one-breach",
  "title": "U.S. v. Paige Thompson (Capital One Cloud Breach)",
  "summary": "Former Seattle cloud engineer who identified misconfigured web application firewalls to gain unauthorized access to Capital One's Amazon Web Services storage buckets, exfiltrating 106 million customer credit card applications.",
  "case_number": "2:19-cr-00159",
  "court": "U.S. District Court for the Western District of Washington",
  "district": "W.D. Wash.",
  "country": "United States",
  "opened_at": "2019-07-29",
  "status": "convicted",
  "victim_sector": "Financial Services, Cloud Computing",
  "victim_country": "United States, Canada",
  "loss_amount_usd": 270000000,
  "loss_amount_note": "Capital One incurred $270 million in customer notifications, legal settlements, and regulatory fines.",
  "first_seen_at": "2019-03-01T00:00:00Z",
  "last_updated_at": "2026-09-04T11:00:00Z",
  "actor_slug": "erratic",
  "defendant_slugs": [
    "paige-thompson"
  ],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1190",
      "evidence_excerpt": "Thompson sent crafted HTTP requests exploiting a Server-Side Request Forgery (SSRF) flaw in a misconfigured open-source ModSecurity WAF.",
      "evidence_locator": "Indictment \u00b6 9, Page 4",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Indictment: U.S. v. Thompson",
      "source_url": "https://www.justice.gov/usao-wdwa/pr/former-seattle-tech-worker-convicted-wire-fraud-and-computer-intrusions",
      "technique_name": "Exploit Public-Facing Application",
      "tactic": "Initial Access"
    },
    {
      "technique_id": "T1078",
      "evidence_excerpt": "Obtained temporary security credentials from the AWS EC2 instance metadata service to access private S3 storage buckets.",
      "evidence_locator": "Trial Transcript Day 3, Page 54",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Trial Record",
      "source_url": "https://www.justice.gov/usao-wdwa/pr/former-seattle-tech-worker-convicted-wire-fraud-and-computer-intrusions",
      "technique_name": "Valid Accounts",
      "tactic": "Defense Evasion"
    },
    {
      "technique_id": "T1083",
      "evidence_excerpt": "Thompson ran automated aws-s3 listing commands to enumerate bucket contents across victim customer directories.",
      "evidence_locator": "Indictment \u00b6 12, Page 6",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Indictment: U.S. v. Thompson",
      "source_url": "https://www.justice.gov/usao-wdwa/pr/former-seattle-tech-worker-convicted-wire-fraud-and-computer-intrusions",
      "technique_name": "File and Directory Discovery",
      "tactic": "Discovery"
    }
  ],
  "events": [
    {
      "event_type": "arrest",
      "event_date": "2019-07-29",
      "description": "FBI agents arrest Thompson at her residence in Seattle."
    },
    {
      "event_type": "verdict",
      "event_date": "2022-06-17",
      "description": "Jury finds Thompson guilty of wire fraud and six counts of unauthorized access to a protected computer."
    },
    {
      "event_type": "sentencing",
      "event_date": "2022-10-04",
      "description": "Sentenced to time served and five years of supervised release with restitution ordered."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Adversary breached the target network via Exploit Public-Facing Application. Thompson sent crafted HTTP requests exploiting a Server-Side Request Forgery (SSRF) flaw in a misconfigured open-source ModSecurity WAF.",
    "blast_radius": "Capital One incurred $270 million in customer notifications, legal settlements, and regulatory fines. Impacted Financial Services, Cloud Computing infrastructure and associated victim operations.",
    "kill_chain": [
      {
        "phase": "Phase 1: Initial Access",
        "title": "Initial Perimeter Infiltration",
        "description": "Thompson sent crafted HTTP requests exploiting a Server-Side Request Forgery (SSRF) flaw in a misconfigured open-source ModSecurity WAF.",
        "technical_artifacts": [
          "T1190",
          "Exploit Public-Facing Application"
        ],
        "mitre_technique_id": "T1190"
      },
      {
        "phase": "Phase 2: Defense Evasion",
        "title": "Defense Evasion & Security Blindfolding",
        "description": "Obtained temporary security credentials from the AWS EC2 instance metadata service to access private S3 storage buckets.",
        "technical_artifacts": [
          "T1078",
          "Valid Accounts"
        ],
        "mitre_technique_id": "T1078"
      },
      {
        "phase": "Phase 3: Discovery",
        "title": "Internal Subnet & Trust Reconnaissance",
        "description": "Thompson ran automated aws-s3 listing commands to enumerate bucket contents across victim customer directories.",
        "technical_artifacts": [
          "T1083",
          "File and Directory Discovery"
        ],
        "mitre_technique_id": "T1083"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across all external remote access endpoints.",
      "Implement network microsegmentation to prevent unrestricted lateral traversal between internal subnets.",
      "Maintain isolated, immutable backups of critical directory services and transaction databases.",
      "Deploy real-time endpoint detection and response (EDR) agents with automated containment policies."
    ]
  }
}