ENKR

Capital One data breach

Add to my breach check

Made public · 106,000,000 people

What leaked10

Hard to replace

  • Income, balances, loans, credit or other financial details
  • Bank account number
  • Mobile number
  • Home or delivery address
  • Email address

Permanent

  • National ID or tax number
  • Social Security number
  • Date of birth
  • Purchase or order history
  • Full name
  • National ID or tax numberabout 1 million Canadian Social Insurance Numbers
  • Social Security numberabout 140,000 card customers, plus about 4,700 found in 2021
  • Income, balances, loans, credit or other financial detailsself-reported income; credit scores, credit limits, balances, payment history
  • Bank account numberabout 80,000 linked accounts of secured card customers
  • Mobile numberphone number · type not stated
  • Purchase or order historyfragments of transaction data from 23 days in 2016-2018
  • Full namecredit card application data, 2005 to early 2019

To-dos11 · about 2 h 30 min in all

  1. Freeze your credit at Equifax, Experian and TransUnionabout 30 minfreeStops: credit in your name · Limits harm from: applications with your ID (opens in a new tab)
  2. Get an IRS Identity Protection PINabout 20 minStops: tax refund fraud (opens in a new tab)
  3. Place a fraud alert on your credit reportsabout 10 minfreeLimits harm from: credit in your name, applications with your ID (opens in a new tab)
  4. Check your credit reports every week, freeabout 20 minfreeHelps you notice: credit in your name, applications with your ID (opens in a new tab)
  5. Turn on instant transaction alertsabout 5 minHelps you notice: bank account fraud, scam calls
6 more
  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Turn on your carrier's port-out lockabout 5 minLimits harm from: SIM swap
  3. Turn on your carrier's SIM-change lockabout 5 minLimits harm from: SIM swap
  4. Freeze your NCTUE phone and utility fileabout 10 minfreeLimits harm from: phone or utility account (opens in a new tab)
  5. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  6. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next18 events

  1. Undetected 2 events119 days · Back to latest
  2. Response 4 eventsNotice in 584 days · show events
  3. Remedy 3 eventsEnded · show events
  4. Penalty 2 eventsFine $80M · show events
  5. Disputes 7 eventsSettled · show events

Undetected: 2 events

Back to latest
  1. Confirmed the intrusion after an outside security researcher reported the configuration flaw on July 17, 2019 through the responsible disclosure program
  2. Intrusion began
Company
Capital One
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
106,000,000 people · approx.: 100 million in the U.S., 6 million in Canada; Capital One

How the facts developed

  1. About 4,700 more U.S. card customers or applicants whose SSNs were in the stolen files (found January 27, 2021)
  2. First notice: about 100 million people in the U.S. and 6 million in Canada; about 140,000 SSNs and 80,000 bank account numbers

Sources