Image copyright Getty Images Image caption The alleged hacker was arrested on Monday

The personal details of about 106 million individuals across the US and Canada were stolen in a hack targeting financial services firm Capital One, the company has revealed.

The alleged hacker, Paige Thompson, was arrested on Monday after reportedly boasting about the breach online.

Capital One said the data included names, addresses and phone numbers of people who applied for its products.

But the hacker did not gain access to credit card account numbers, it said.

The data breach is believed to be one of the largest in banking history.

How many people have been affected?

Capital One is a major credit card issuer in the US and also operates retail banks.

The firm said in a statement released on Monday that the breach affected approximately 100 million individuals in the US and six million people in Canada.

The statement added that about 140,000 social security numbers and 80,000 linked bank account numbers were compromised in the US.

In Canada, about one million social insurance numbers belonging to Capital One credit card customers were also compromised.

The hack was identified on 19 July.

Capital One said the hacker was able to "exploit" a "configuration vulnerability" in the company's infrastructure.

Aside from names and dates of birth, the hacker also managed to obtain credit scores, limits, balances, payment history and contact information.

A selection of the biggest data breaches worldwide

How has Capital One reacted?

Capital One said it was unlikely the information was used for fraud but it would continue to investigate the breach.

The company will notify those affected and will provide them with free credit monitoring and identity protection.

Chairman Richard Fairbank said in a statement: "While I am grateful that the perpetrator has been caught, I am deeply sorry for what has happened.

"I sincerely apologise for the understandable worry this incident must be causing those affected and I am committed to making it right. "

What do we know about the alleged hacker?

The US justice department has confirmed it has arrested a former Seattle technology company software engineer in connection with the breach.

Ms Thompson, 33, was arrested on Monday on charges of computer fraud and abuse. She made an initial appearance in federal court in Seattle.

A hearing has been scheduled for 1 August.

Court documents claim she boasted about the data breach on an online forum.

A statement by the US attorney's office in Washington said: "On July 17 2019, a GitHub user who saw the post alerted Capital One to the possibility it had suffered a data theft."

Ms Thompson faces a maximum sentence of five years in prison and a $250,000 (£204,713) fine.

You may also be interested in: </s> Woman arrested after hacker steals 106 million people's data from Capital One

Woman arrested after hacker steals 106 million people's data from Capital One

Capital One has admitted approximately 106 million customers' details were stolen

A woman has been arrested in connection with a data breach at credit card firm Capital One affecting approximately 106 million people.

Paige Thompson, 33, was arrested by the FBI in Seattle on Monday on suspicion of computer fraud and abuse.

The former Amazon employee is accused of stealing customer data from a misconfigured Amazon server which Capital One was using to handle customer credit applications.

Customer names, physical and email addresses, phone numbers and dates of birth were among the data that the hacker downloaded, as were credit scores.

However no credit card account numbers or log-in credentials were accessed, the company added.

The data breach is believed to have affected approximately 100 million customers in the US and six million more in Canada.

Free credit monitoring services will be offered to those affected.

According to the indictment, Thompson operated a Twitter account with the username "Erratic" from which she is alleged to have threatened to disseminate the stolen material.

Capital One stated: "Based on our analysis to date, we believe it is unlikely that the information was used for fraud or disseminated by this individual."

The firm's chairman and chief executive Richard Fairbank said: "While I am grateful that the perpetrator has been caught, I am deeply sorry for what has happened.

"I sincerely apologise for the understandable worry this incident must be causing those affected and I am committed to making it right." </s> MCLEAN, Va. (WRIC) — Capital One, the Virginia-based bank announced Monday that earlier this month ‘an outside person’ obtained information relating to people who had applied to Capital One credit cards.

In a press release, Capital One says the breach of data has affected 100 million individuals in the United States and 6 million in Canada.

According to Capital One, the data breach took place on July 17. An internal investigation led to the discovery of the incident on July 19.

“While I am grateful that the perpetrator has been caught, I am deeply sorry for what has happened,” Richard D. Fairbank, Chairman and CEO said. “I sincerely apologize for the understandable worry this incident must be causing those affected and I am committed to making it right.”

Capital One says the information accessed pertained to people who had applied to one of their credit card products from 2005 through early 2019.

The Department of Justice said a Seattle tech worker was arrested for data theft involving large financial services company, Capital One.

33-year-old Paige A. Thompson was arrested and charged for computer fraud and abuse. According to the criminal complaint, Thompson allegedly posted on GitHub about her theft of information from the servers storing Capital One data.

GitHub alerted Capital One, who then called the FBI.

“Capital One quickly alerted law enforcement to the data theft — allowing the FBI to trace the intrusion,” U.S. Attorney Moran said. “I commend our law enforcement partners who are doing all they can to determine the status of the data and secure it.”

Computer fraud is punishable by up to five years in prison and a $250,000 fine.

Capital One said the hacker was able to collect the ‘personal information Capital One routinely collects at the time it receives credit card applications, including names, addresses, zip codes/postal codes, phone numbers, email addresses, dates of birth, and self-reported income.’

The company says they will make free credit monitoring and identity protection available to everyone affected.

The data breach is expected to cost Capital One approximately $100 to $150 million.

Capital One says it will notify all customers affected by the breach in the coming days. </s> CBJ — Capital One Financial says that the personal information — including names, addresses, phone numbers and credit scores — of about 100 million individuals in the United States and six million people in Canada were obtained by a hacker.

About one million social insurance numbers of the company’s Canadian credit card customers were also compromised.

Capital said it became aware of the hack on July 19.

The U.S. Justice Department said 33-year-old Paige Thompson, a former Seattle technology company software engineer, was arrested on a criminal complaint charging computer fraud and abuse for hacking into Capital One Financial’s stored data.

About 140,000 social security numbers and 80,000 linked bank account numbers were compromised, Capital One said. The company also said credit card numbers were not affected.

The breach is expected to cost between $100 million US and $150 million in 2019, mainly due to customer notifications, credit monitoring and legal support, Capital One said.

The hacker allegedly posted on the information sharing site GitHub about the theft of information from the servers storing Capital One data. Investigators allege it was obtained through a “misconfigured web application firewall that enabled access.”

A GitHub user alerted Capital One to the potential data theft, who in turn alerted the Federal Bureau of Investigation, according to the DOJ’s statement.

The allegations have not been proven in court. </s> Roman Tiraspolsky/iStock(SEATTLE) — A Seattle-area woman was arrested on Monday morning in connection with a newly-disclosed Capital One data breach that impacted more than 100 million people.

Capital One said it identified a security breach on July 19 when an unauthorized source “obtained certain types of personal information” related to credit card customers and others who had applied for products, the company said in a statement on Monday.

“Capital One immediately fixed the configuration vulnerability that this individual exploited and promptly began working with federal law enforcement,” the statement said. “Based on our analysis to date, this event affected approximately 100 million individuals in the United States and approximately 6 million in Canada.”

Specifically, the bank believes about 140,000 Social Security numbers of its credit card customers and around 80,000 linked bank account numbers were compromised, according to the statement.

Paige Thompson, who goes by the nickname “erratic,” was arrested on one count of computer fraud and abuse, according to court documents filed in the Western District of Washington on Monday.

Thompson attempted to intrude on Capital One’s server numerous times between March and July and succeeded at least once, federal authorities said.

Some of the information was encrypted, according to court documents, but “tens of millions” of credit card applications were not.

“Although some of the items were tokenized or encrypted, other information including applicants’ names, address, dates of birth and information on their credit history has not been tokenized,” prosecutors said in a criminal complaint.

Thompson allegedly bragged online about the hack, according to court documents.

“I’ve basically strapped myself with a bomb vest, f—— dropping capitol ones dox and admitting it,” she allegedly wrote in a Twitter direct message, according to court documents. “There ssns (Social Security Number)…full name and dob.”

Authorities searched Thompson’s home and “agents observed files and items that referenced Capital One and the cloud computing company, other entities that may have been the targets of attempted or actual network intrusions,” the complaint said.

The breach will cost the firm between $100 million and $150 million in 2019, the company said, citing costs related to customer notifications, credit monitoring, technology costs and legal support. </s> SEATTLE -- A hacker gained access to personal information from more than 100 million Capital One credit applications, including six million from Canada, the bank said Monday as federal authorities arrested a suspect in the case.

Paige A. Thompson -- who also goes by the handle "erratic" -- was charged with a single count of computer fraud and abuse in U.S. District Court in Seattle. Thompson made an initial appearance in court and was ordered to remain in custody pending a detention hearing Thursday.

The hacker got information including credit scores and balances plus the Social Security numbers of about 140,000 customers in the United States, the bank said. It will offer free credit monitoring services to those affected.

In Canada, where it provides Mastercard credit cards for Costco Wholesale's Canadian retail network, Capital One said approximately one million Social Insurance Numbers were compromised in this incident.

The FBI raided Thompson's residence Monday and seized digital devices. An initial search turned up files that referenced Capital One and "other entities that may have been targets of attempted or actual network intrusions."

A public defender appointed to represent Thompson did not immediately return an email seeking comment.

Capital One, based in McLean, Virginia, said Monday it found out about the vulnerability in its system July 19 and immediately sought help from law enforcement to catch the perpetrator.

According to the FBI complaint, someone emailed the bank two days before that notifying it that leaked data had appeared on the code-hosting site GitHub, which is owned by Microsoft.

And a month before that, the FBI said, a Twitter user who went by "erratic" sent another user direct messages warning about distributing the bank's data, including names, birthdates and Social Security numbers. That user later reported the message to Capital One.

"Ive basically strapped myself with a bomb vest, (expletive) dropping capitol ones dox and admitting it," one said. "I wanna distribute those buckets i think first."

Capital One said it believes it is unlikely that the information was used for fraud, but it will continue to investigate. The data breach affected about 100 million people in the U.S. and six million in Canada.

The bank said the bulk of the hacked data consisted of information supplied by consumers and small businesses who applied for credit cards between 2005 and early 2019. In addition to data such as phone numbers, email addresses, dates of birth and self-reported income, the hacker was also able to access credit scores, credit limits and balances, as well as fragments of transaction information from a total of 23 days in 2016, 2017 and 2018.

"While I am grateful that the perpetrator has been caught, I am deeply sorry for what has happened," said Capital One CEO Richard D. Fairbank. "I sincerely apologize for the understandable worry this incident must be causing those affected and I am committed to making it right."

Capital One Financial Corp., the nation's seventh-largest commercial bank with $373.6 billion in assets as of June 30, is the latest U.S. company to suffer a major data breach in recent years.

In Canada, Desjardins Group revealed a data breach in June that saw the leak of names, addresses, birthdates, social-insurance numbers and other private information from roughly 2.7 million people and 173,000 businesses.

Desjardins, a Quebec-based co-operative, said a single employee, who has been fired since the breach was detected in December 2018, was responsible. A police investigation into the incident is ongoing.

In 2017, a data breach at Equifax, one of the major credit reporting companies, exposed the Social Security numbers and other sensitive information of roughly half of the U.S. population and about 19,000 Canadians.

Canada's Office of the Privacy Commissioner concluded in April that the company fell short of their privacy obligations to Canadians, including poor security safeguards and holding information too long, but it did not level fines.

Last week, Equifax agreed to pay at least $700 million to settle lawsuits over the breach in a settlement with federal authorities and states. The agreement includes up to $425 million in monetary relief to consumers.

The average cost of a data breach in the U.S. last year was just under $8 million, according to a study by IBM Security and Ponemon Institute. </s> This Monday, July 22, 2019, photo shows Capital One mailing in North Andover, Mass. Capital One says a hacker got access to the personal information of over 100 million individuals applying for credit. The McLean, Virginia-based bank said Monday, July 29, 2019, it found out about the vulnerability in its system July 19 and immediately sought help from law enforcement to catch the perpetrator. (AP Photo/Elise Amendola)

SEATTLE (AP) — A security breach at Capital One Financial, one of the nation’s largest issuers of credit cards, compromised the personal information of about 106 million people, and in some cases the hacker obtained Social Security and bank account numbers.

It is among the largest security breaches of a major U.S. financial institution on record. The bank’s stock dipped 6% at the opening of trading Tuesday.

Paige A. Thompson, who uses the online handle “erratic” — was charged with a single count of computer fraud and abuse in U.S. District Court in Seattle. Thompson made an initial appearance in court and was ordered to remain in custody pending a detention hearing Thursday.

Federal agents began tracking Thompson online after being notified by Capital One of a possible breach in July.

On June 18, Thompson sent a message on Twitter to another user saying, “Ive basically strapped myself with a bomb vest, (expletive) dropping capitol ones dox and admitting it.”

The FBI raided Thompson’s residence Monday and seized digital devices. An initial search turned up files that referenced Capital One and “other entities that may have been targets of attempted or actual network intrusions.”

Thompson was a systems engineer at Amazon Web Services between 2015 and 2016, about three years before the breach took place.

While that service is used by Capital One, there is no evidence that Amazon’s cloud system was involved in the breach.

“AWS was not compromised in any way and functioned as designed,” a company spokesperson said Tuesday. “The perpetrator gained access through a misconfiguration of the web application and not the underlying cloud-based infrastructure. As Capital One explained clearly in its disclosure, this type of vulnerability is not specific to the cloud.”

Capital One Financial Corp. was notified by a third party on July 19 that their data had appeared on the code-hosting site GitHub, which is owned by Microsoft. The McLean, Virginia, company says it immediately notified the FBI.

The FBI said a Twitter user who went by “erratic” sent a user direct messages warning about distributing the bank’s data, including names, birthdates and Social Security numbers. That user reported the message to Capital One.

Capital One said it believes it is unlikely that the information was used for fraud, but the investigation is ongoing.

The data breach involves about 100 million people in the U.S. and 6 million in Canada.

The bank said the bulk of the hacked data consisted of information supplied by consumers and small businesses who applied for credit cards between 2005 and early 2019. In addition to data such as phone numbers, email addresses, dates of birth and self-reported income, the hacker was also able to access credit scores, credit limits and balances, as well as fragments of transaction information from a total of 23 days in 2016, 2017 and 2018.

“While I am grateful that the perpetrator has been caught, I am deeply sorry for what has happened,” said Capital One CEO Richard Fairbank. “I sincerely apologize for the understandable worry this incident must be causing those affected and I am committed to making it right.”

Capital One Financial Corp., the nation’s seventh-largest commercial bank with $373.6 billion in assets as of June 30, is the latest U.S. company to suffer a major data breach in recent years.

In 2017, a data breach at Equifax, one of the major credit reporting companies, exposed the Social Security numbers and other sensitive information of roughly half of the U.S. population.

Last week, Equifax agreed to pay at least $700 million to settle lawsuits over the breach in a settlement with federal authorities and states. The agreement includes up to $425 million in monetary relief to consumers.

Many major banks have sought to stem the risk of data breaches in recent years. JPMorgan Chase, Bank of America and Citibank began replacing customers’ debit cards several years ago with more secure chip-based cards. While the cards with chips are common these days, many merchants still rely on the older, less secure card-swiping equipment. Credit card companies have also beefed up fraud monitoring in the wake of high-profile data breaches that hit retailers such as Target and Home Depot.

The average cost of a data breach in the U.S. last year was just under $8 million, according to a study by IBM Security and Ponemon Institute.

A public defender appointed to represent Thompson did not immediately return an email seeking comment.

This story has been corrected to show Twitter messages were sent to a third party, not directly to Capital One.

Associated Press reporter Alex Veiga in Los Angeles contributed to this article. </s> Capital One revealed on Monday that it recently suffered a massive security breach when a hacker gained access to personal information from around 100 million people in the U.S. and around 6 million in Canada.

The Department of Justice simultaneously announced federal authorities had arrested the suspect, Paige A. Thompson, a 33-year-old former Seattle technology company software engineer.

According to a release, Thompson used knowledge of servers and cloud storage to steal data from millions of Capital One credit card applications.

The FBI arrested Thompson Monday for the data theft, which occurred sometime between March 12 and July 17, court records show.

Thompson, who also goes by the handle "erratic," made a court appearance Monday and was ordered detained until a hearing Thursday, the Department of Justice said. Thompson was charged with computer fraud and abuse, according to court records. She could face up to 5 years in prison and a $250,000 fine, according to the DOJ.

The McLean, Virginia-based bank said in a release that the "largest category of information accessed" included personal details collected for credit card applications from 2005 through early 2019. The information included applicants' names, addresses, zip codes, phone numbers, e-mail addresses, dates of birth and self-reported income.

The bank emphasized that it believes no credit card account numbers or log-in credentials were compromised. However, it said about 140,000 credit card customers had their Social Security numbers exposed, and 80,000 bank account numbers linked to credit cards were compromised.

It plans to offer free credit monitoring services to those affected.

The company added that based on its analysis so far they believe it's unlikely the information "was used for fraud or disseminated by this individual."

Court documents allege Thompson posted on the sharing site GitHub about stealing information from servers that stored Capital One data. She was reportedly able to get in through a misconfigured firewall.

On July 17, another user who saw Thompson's post on GitHub alerted Capital One that a hacker may have stolen some of its data, according to court documents.

RELATED: Equifax to pay up to $700M in data breach settlement

RELATED: Marriott: Up to 500 million guests' information possibly compromised in data breach

Capital One explained that it confirmed two days later, on July 19, that an outside individual had indeed obtained "certain types of personal information relating to people who had applied for its credit card products and to Capital One credit card customers. The company then alerted the FBI.

According to the FBI complaint, a month before a Twitter user who went by "erratic" sent Capital One direct messages warning about distributing the bank's data, including names, birthdates and Social Security numbers.

"Ive basically strapped myself with a bomb vest, (expletive) dropping capitol ones dox and admitting it," one said. "I wanna distribute those buckets i think first."

On Monday morning, the FBI executed a search warrant at Thompson's home and seized storage devices that contained a copy of the data, according to the U.S. Attorney's Office for the Western District of Washington.

“Capital One quickly alerted law enforcement to the data theft -- allowing the FBI to trace the intrusion,” said U.S. Attorney Moran. “I commend our law enforcement partners who are doing all they can to determine the status of the data and secure it.”

Capital One's CEO said they were grateful the hacker has been caught, but are "deeply sorry for what has happened."

"I sincerely apologize for the understandable worry this incident must be causing those affected and I am committed to making it right," CEO Richard D. Fairbank said in a statement.

Monday's disclosure comes just one week after Equifax announced it would be paying up to $700 million to settle lawsuits over its 2017 data breach.

Capital One has set up a website for customers to see updated information about the incident and the company's response. It expects the incident to cost the company $100 to $150 million.

The average cost of a data breach in the U.S. last year was just under $8 million, according to a study by IBM Security and Ponemon Institute.

According to USA TODAY, the Capital One incident is among the top 10 biggest data breaches in history.

The Associated Press contributed to this report. </s> Capital One Financial Corp. set up an email address for tipsters — including “white hat” hackers — to alert the company to potential vulnerabilities in its computer systems. On July 17, the company got a hit.

“Hello there,” the email said, according to federal prosecutors. “There appears to be some leaked s3 data of yours in someone’s github/gist.” A link was provided to an account at GitHub, a company that allows users to manage and store project revisions, mostly related to software development.

It didn’t take Capital One long to figure out who had accessed its files. The GitHub address included a name, Paige Thompson, a former Amazon.com employee who used the online nickname “erratic” and discussed her exploits with others, according to federal prosecutors.

“I’ve basically strapped myself with a bomb vest, (expletive) dropping capitol ones dox and admitting it,” Thompson allegedly wrote, under the “erratic” alias, in a June 18 Twitter message. “There ssns … with full name and dob” — an apparent reference to Social Security numbers.

It also didn’t take Capital One much time to assess the damage. On Monday, it announced that about 100 million people in the U.S. had been impacted by the breach, and another 6 million in Canada. The illegally accessed data, which was stored on servers rented from Amazon Web Services, was primarily related to credit card applications and included personal information, like names, addresses and dates of birth, and some financial information, including self-reported income and credit scores.

Most Social Security numbers were protected, but about 140,000 were compromised, the bank said. Capital One said it was “unlikely that the information was used for fraud or disseminated by this individual.”

The company described the tipster to the hack as an “external security researcher.”

Thompson, 33, was charged with computer fraud and abuse. In a court hearing Monday, she broke down and laid her head on the defense table.

The scale of the breach ranks it as possibly one of the largest-ever impacting a U.S. bank, although the consequences may be limited if the data wasn’t distributed to others or used for fraud.

Still, the breach shows how hackers can steal vast troves of consumer data as the result of lapses made by the companies that collect it. In 2017, Equifax Inc. failed to patch a known flaw in its servers, resulting in the theft of 145 million Social Security numbers, along with the names and dates of birth of possibly a third of the U.S. population.

In the Capital One case, Thompson was allegedly able to steal vast buckets of personal data because of an improperly configured firewall — among the most basic digital security tools. The bank said it immediately fixed the problem once it was discovered.

In a complaint filed Monday in Seattle, prosecutors said that Thompson accessed the data at various times between March 12 and July 17. A file on her GitHub account, timestamped April 21, contained a list of more than 700 folders and buckets of data, according to prosecutors.

The Capital One data had been stored on servers it contracted from a cloud computing company that isn’t identified, though the charges against Thompson refer to information stored on S3, a reference to Amazon Web Services’ popular data storage software.

An AWS spokesman confirmed that the company’s cloud had stored the Capital One data that was allegedly stolen, and said it wasn’t accessed through a breach or vulnerability in its systems.

Capital One has been one of the most vocal advocates for using cloud services among banks. The lender has said it is migrating an increasing percentage of its applications and data to the cloud and plans to completely exit its data centers by the end of 2020. The move will help lower costs, the company has said.

The lender has been the subject of several case studies published by Amazon Web Services that noted the cloud services provider has helped the company develop new technologies faster and improve certain services including its call center.

“We have embraced the public cloud and are well on our way to migrating our applications and data to the cloud,” Chief Executive Officer Richard Fairbank told analysts on a conference call in April. “We are now considered one of the most cloud forward companies in the world.”

Thompson, previously an Amazon Web Services employee, last worked at Amazon in 2016, a spokesman said. The breach described by Capital One didn’t require insider knowledge, he said.

Much of what could be learned about her Monday was information she had posted online. On her GitHub Account, she was writing code dealing with The Onion Router, or Tor, an anonymity tool that allows users to conceal their identities. Capital One investigators determined that Thompson used it in her hack of the bank, according to federal prosecutors.

In online interactions, Thompson suggested she was careful to hide her digital tracks with various security tools, including Tor. But the federal complaint against her outlines relatively simple ways Capital One and the FBI were able to establish her identity, including the name on her GitHub Page.

Thompson was active in the hacking community on Twitter, and she wrote recently about struggling emotionally, and about euthanizing her beloved cat.

On June 27, “erratic” posted about several companies, including Capital One, in an online group, according to court records.

“don’t go to jail plz,” another user wrote.

“Wa wa wa wa, wa wa wa wa wa wa wawaaaaaaaaaaaa,” Thompson responded, and later added, “I just don’t want it around though. I gotta find somewhere to store it.”

On July 29, Federal Bureau of Investigation agents executed a warrant to search Thompson’s residence. In one bedroom, they found digital devices with files that referenced Capital One and its cloud computing company. The devices also included the alias “erratic.”

To contact the reporters on this story: Christian Berthelsen in New York at cberthelsen1@bloomberg.net;William Turton in New York at wturton1@bloomberg.net;Jenny Surane in New York at jsurane4@bloomberg.net

To contact the editors responsible for this story: Andrew Martin at amartin146@bloomberg.net, Peter Elstrom

For more articles like this, please visit us at bloomberg.com
Capital One announces that a major data breach occurred on July 19, 2019, by one individual who compromised the data of about 106 million people in the United States and Canada. The Federal Bureau of Investigation have made an arrest after the alleged hacker, 33-year-old Paige Thompson from Seattle, boasted about her actions online.