Capital One Reports a Major Data Breach Affecting 106 Million Individuals in the USA & Canada

Last updated September 28, 2021
Written by:
Novak Bozovic
Novak Bozovic
Senior VPN Editor

Capital One has publicly revealed a data breach affecting 106 million individuals, exposing their personal data to third parties. A hacker managed to retrieve personal information of individuals from the United States and Canada, who applied for this bank’s credit card products. The FBI was involved in this investigation, and the person responsible for this data is already in custody.

This data breach was first reported to Capital One on July 17, 2019. An ethical hacker found a vulnerability in a misconfigured Web application firewall that allowed third parties to obtain personal information of this bank’s clients. Upon further investigation of whether this vulnerability had been used in the past, an instance of unauthored access was detected, happening between March 22 and 23, 2019. Based on current analysis, the event affected 100 million individuals in the United States and approximately 6 million in Canada.

No credit card numbers or log-in credentials were stolen, and over 99 percent of social security numbers were not compromised. Still, a wide range of personal information was accessed. As per Capital One’s press release, the following types of data were stolen:

According to a press release by the Department of Justice, a person responsible for this data breached was identified and then arrested by the FBI. Named Paige Thompson (33), one of the first clues about this person appeared on GitHub. She had posted a comment on this website about her access to Capital One’s data. Thompson was one of the organizers of a Meetup group called the Seattle Warez Kiddies, as reported by the New York Times. Even though she used an alias online, the FBI managed to match her alias to a number of online accounts (including Twitter and Slack). Upon executing a search warrant at Thompson’s residence, electronic storage devices containing a copy of the data had been discovered. The hacker is now in custody, facing 'computer fraud and abuse' charges – punishable by up to five years in prison and a $250,000 fine. You can find the full DOJ complaint online, with additional details of the investigation.

Capital One is currently in the process of contacting individuals affected by this breach, and the bank will be providing free credit monitoring services. However, if you’re a Capital One customer, it’s recommended to monitor your credit card report for any suspicious activity. In case you detect anything strange, don’t hesitate to report the problem to the police, Capital One, and your credit agency.

Finally, Capital One estimates that the costs of this data breach will be from $100 to $150 million in 2019. These will be mostly driven by customer notifications, credit monitoring, technology costs, and legal support. Even though these costs might sound like bad news for Capital One, the bank says that it has cyber-security insurance covering up to $400 million with a $10 million deductible.

Were you affected by this breach or any similar breach of personal information? Make sure to let us know in the comments section below, and don’t forget to follow us via our social media profiles, on Facebook and Twitter. Thanks!



For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: