In 2019, a misconfigured firewall in AWS exposed the personal information of over 100 million Capital One customers. The breach resulted in significant financial losses and legal consequences, including fines, settlements, and damage to the company's reputation.
The breach was initiated by a former AWS employee who exploited the misconfigured firewall to gain access to sensitive customer information, including names, addresses, credit scores, and social security numbers. The attacker utilized a vulnerability in AWS' infrastructure to conduct a Server Side Request Forgery (SSRF) attack, manipulating the system to execute unauthorized commands.