Capital One Breach: How a Cloud Misconfiguration Was Used

The Capital One breach was not a password guess. A scanning tool found cloud accounts that were set up wrongly, and the data inside them was reachable.

By Siddharth ShankarUpdated October 11, 2026

When a large company is breached, people imagine a sophisticated attack on its defenses. The 2019 Capital One case is a more ordinary and more instructive story. The weak point was configuration. A person with the right scanning tool could find cloud accounts that were not set up properly and use them to reach stored data.

What happened

According to the Justice Department, a federal jury convicted Paige A. Thompson in June 2022 after a seven-day trial of wire fraud, five counts of unauthorized access to a protected computer and one count of damaging a protected computer. On October 4, 2022, she was sentenced to time served and five years of probation, with location and computer monitoring. Prosecutors had sought seven years. A restitution hearing was set for December 1, 2022.

How it worked

The release says she built a tool to scan Amazon Web Services accounts for what it calls misconfigured accounts. She used the tool to find accounts that she could access and then downloaded data from more than 30 entities, including Capital One. She also installed cryptocurrency mining software on some servers.

The important point is that the targets were not defeated in a technical sense. Their settings allowed access. Cloud services are flexible, and a single permission or firewall rule that is too wide can open a door.

What was exposed

The release does not list specific data categories, and we do not guess. It does describe the damage in another way: the US Attorney said her conduct "did more than $250 million in damage to companies and individuals." Capital One's customers and applicants were among those whose data was reached, but the release should be consulted for exact details.

How it ended

For victims the outcome is unsatisfying. The sentence was time served and probation, well below the seven years prosecutors had asked for, and the release leaves the restitution amount to a later hearing. The companies involved bore remediation costs, and individuals bore the risk that their details are now in circulation. This case also resulted in civil and regulatory actions beyond the scope of the release we cite.

Key facts at a glance

• Verdict: convicted in June 2022 on wire fraud and computer offenses
• Sentence: time served and five years of probation
• Date of sentence: October 4, 2022
• Method: scanning cloud accounts for misconfiguration
• Organizations affected: more than 30
• Stated damage: more than $250 million, according to the US Attorney

A timeline of the case

The breach dates to 2019. A federal jury convicted Paige Thompson in June 2022, and she was sentenced on October 4, 2022. Prosecutors had sought seven years, the court imposed time served and five years of probation, and the question of restitution was left to a later hearing.

Three years passed between the conduct and the sentence. During that time, people whose data was reached could not know how the case would end, which is a reminder that individual protection should not wait for a verdict.

What it means for you

You cannot fix another company's cloud settings. You can reduce the damage from a breach at any of them.

What the release does not say

The release does not give the number of individuals affected or the final restitution figure. Because of that, this report does not either. For another breach tied to a supplier, see the Blackbaud donor-data case.

To turn the lesson into action, our guides explain what each type of breached data means, how to tell a real breach notice from a phishing message and what to do after your email appears in a breach. You can also try our free email exposure check.