One of America’s biggest banks took four months to realise it had been hacked.
Signal could have helped the bank find and respond sooner to reduce their reputational damage.
In late July the $370bn bank Capital One announced a hack of one million social security numbers and 80,000 credit card-linked bank account numbers which is estimated to cost over $100m to remedy.
Their announcement came 120 days after the actual hack occurred - the vigilant monitoring that Signal provides could have alerted Capital One to the problem quickly. Instead, it took months before a ‘white hat’ noticed conversation about the breach.
The number of people affected was staggeringly high – in the words of Capital One itself, “The event affected approximately 100 million individuals in the United States and approximately 6 million in Canada.”
Here’s what happened:
On July 19, 2019, it was determined there had been unauthorised access by an outside individual who obtained personal information relating to Capital One credit card customers.
Capital One says it immediately fixed the configuration vulnerability that the individual had exploited and promptly began working with federal law enforcement.
The FBI arrested Paige Thompson, 33, a software engineer who formerly worked for Amazon Web Services… which Capital One is known to use.
Charges against Ms Thompson state she boasted about the hack on GitHub, Slack, and Twitter, allowing Capitol One the opportunity to quickly alert their cyber teams of a potential breach – if they were utilizing an OSINT tool like Signal.
Capital One claims it is unlikely the information stolen was used for fraud or disseminated by the individual, adding it believes no credit card account numbers or log-in credentials were compromised and that over 99 percent of Social Security numbers were not compromised.
The fact remains: one million social insurance numbers and 80,000 credit card-linked bank account numbers were exposed.
The largest category of information accessed was information on consumers and small businesses created when they applied for credit card products across the last 15 years, including:
Customer status data, credit scores, credit limits, balances, payment history, contact information
Fragments of transaction data from a total of 23 days during 2016, 2017 and 2018
140,000 Social Security numbers of credit card customers
80,000 linked bank account numbers of our secured credit card customers
The Social Insurance Numbers of one million Canadian credit card customers were also compromised in this incident.
The configuration vulnerability was reported to Capital One by an external security researcher through a Responsible Disclosure Program on July 17, 2019. Capital One then began their own internal investigation, leading to the July 19, 2019, discovery of the incident. the hacker had four months to do what she wished with people’s personal information. Unfortunately, it is common for hacks to take months to be discovered, reported, and patched if the proper monitoring solutions are not in place.
Capital One expects the incident to generate incremental costs of approximately $100-$150 million in 2019. Expected costs are driven by customer notifications, credit monitoring, technology costs, and legal support and notifying customers.
Capital One said in its public statement it has always invested heavily in cybersecurity and will continue to do so. This breach shows how the convergence of cyber and physical security is continuing to evolve as companies continue to invest in infrastructure and tools to stay at the forefront of cyber threats. As threat surfaces continue to increase, social media and dark web scanning tools have become even more important to identify threats in real time.
Clearly there’s a lot of money at stake, but the worst part of it all is the hacker boasted about it online and the response could have been a lot quicker.
While it doesn’t appear that the breach was for financial gain, the reputational damage for Capital One has been huge (and continues).
Here’s how signal can help prevent this sort of thing happening:
Signal’s point of difference is scanning the web and dark web for chat around data hacks, breaches and stolen information for sale.
We know that the accused thief bragged about what she was alleged to have done to Capital One, and this is precisely the sort of thing Signal is set up to prevent.
Signal offers:
Monitoring over 15 data sources, including social media, web/forums, surface web, the dark web and online forums.
Accurate real-time results centred around the geographical locations you need to monitor
Advanced filtering of searches
Excellent visuals so you’re not sifting through raw data to find out who’s talking about hacks at your organisation
Situation awareness
Online operation centre capability and data
Please feel free to read how Signal could have helped resolve
A British banker selling stolen data on the dark web (and being exploited until he was driven to steal even more)
Slow responses to crises emerging in the real world outside a business
Parsing the dark web and seeing discussions about plans to rip off your bank or business
Mitigating the Threat of Credential Stuffing through Dark Web Monitoring