ENKR

Capital One data breach

Add to my breach check

Made public · 106,000,000 people

What leaked10

Hard to replace

  • Income, balances, loans, credit or other financial details
  • Bank account number
  • Mobile number
  • Home or delivery address
  • Email address

Permanent

  • National ID or tax number
  • Social Security number
  • Date of birth
  • Purchase or order history
  • Full name
  • National ID or tax numberabout 1 million Canadian Social Insurance Numbers
  • Social Security numberabout 140,000 card customers, plus about 4,700 found in 2021
  • Income, balances, loans, credit or other financial detailsself-reported income; credit scores, credit limits, balances, payment history
  • Bank account numberabout 80,000 linked accounts of secured card customers
  • Mobile numberphone number · type not stated
  • Purchase or order historyfragments of transaction data from 23 days in 2016-2018
  • Full namecredit card application data, 2005 to early 2019

To-dos11 · about 2 h 30 min in all

  1. Freeze your credit at Equifax, Experian and TransUnionabout 30 minfreeStops: credit in your name · Limits harm from: applications with your ID (opens in a new tab)
  2. Get an IRS Identity Protection PINabout 20 minStops: tax refund fraud (opens in a new tab)
  3. Place a fraud alert on your credit reportsabout 10 minfreeLimits harm from: credit in your name, applications with your ID (opens in a new tab)
  4. Check your credit reports every week, freeabout 20 minfreeHelps you notice: credit in your name, applications with your ID (opens in a new tab)
  5. Turn on instant transaction alertsabout 5 minHelps you notice: bank account fraud, scam calls
6 more
  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Turn on your carrier's port-out lockabout 5 minLimits harm from: SIM swap
  3. Turn on your carrier's SIM-change lockabout 5 minLimits harm from: SIM swap
  4. Freeze your NCTUE phone and utility fileabout 10 minfreeLimits harm from: phone or utility account (opens in a new tab)
  5. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  6. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next18 events

  1. Undetected 2 events119 days · show events
  2. Response 4 eventsNotice in 584 days · show events
  3. Remedy 3 eventsEnded · show events
  4. Penalty 2 eventsFine $80M · show events
  5. Disputes 7 eventsSettled · show events
  1. Payments to eligible claimants began; a second payment followed on September 4, 2024
  2. Sentence: time served and five years of probation; the scheme cost the bank 270 million USD per the report
  3. Claims for lost time and out-of-pocket lossesClosed
  4. Final approval of the class settlement for about 98 million U.S. consumers; free identity defense services later extended to February 13, 2028
  5. The attacker was found guilty of wire fraud and computer intrusion counts at a June 2022 trial
13 more
  1. Preliminary approval of the class settlement
  2. Notified about 4,700 more U.S. card customers or applicants whose SSNs were found among the stolen data on January 27, 2021; two years of free credit monitoring
  3. Agreed in the fourth quarter of 2021 to settle the U.S. consumer class actions for 190 million USD
  4. Cease and desist order issued with the penalty
  5. 80 million USD civil money penalty for weak risk assessment before moving IT operations to the public cloud
  6. U.S. consumer class actions consolidated in an MDL in the Eastern District of Virginia
  7. Capital One: based on its analysis to date, it believed the information unlikely to have been used for fraud or spread by the arrested person
  8. The FBI arrested the person responsible
  9. Offered free credit monitoring and identity protection to everyone affected
  10. The chairman and CEO apologised
  11. Announced the breach: about 100 million people in the U.S. and 6 million in Canada; the configuration flaw was fixed and the FBI had arrested a suspect
  12. Confirmed the intrusion after an outside security researcher reported the configuration flaw on July 17, 2019 through the responsible disclosure program
  13. Intrusion began
Company
Capital One
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
106,000,000 people · approx.: 100 million in the U.S., 6 million in Canada; Capital One

How the facts developed

  1. About 4,700 more U.S. card customers or applicants whose SSNs were in the stolen files (found January 27, 2021)
  2. First notice: about 100 million people in the U.S. and 6 million in Canada; about 140,000 SSNs and 80,000 bank account numbers

Sources