Capital One Breach Shows a Bank Hacker Needs Just One Gap to Wreak Havoc
02 Aug 2019

Large financial companies have to thwart hundreds of thousands of cyberattacks every single day. Data thieves have to get lucky only once.

Big banks like Capital One, the victim of a recent attack that captured the personal information of over 100 million people, are a target for digital troublemakers, like individual hackers trying to impress their peers or intelligence operatives for foreign governments.

A single weak spot is all savvy hackers need. And they often find them. Already this year, there have been 3,494 successful cyberattacks against financial institutions, according to reports filed with the Treasury Department’s Financial Crimes Enforcement Network.

Federal law enforcement officials said on Monday that Paige Thompson, a software engineer in Seattle who used to work for Amazon, got into Capital One’s computer network through what the bank described as a “configuration vulnerability” in its security software. It was akin to leaving a window open overnight at the local bank.

Once inside, she was able to download an array of personal material from customers, including credit card applications and Social Security numbers, according to court documents.

Security experts are likely to home in on the apparently simple mistake made by software developers at Capital One, said Jack Jones, the chairman of the FAIR Institute, a cybersecurity trade group. But simple mistakes are common when it comes to online security.

Every big organization faces so many threats from so many sources that it can be hard to decide what is important. Mastercard, for example, combats some 460,000 intrusion attempts in a typical day, up 70 percent from a year ago.

“They’re lost in noise,” Mr. Jones said. “Nobody has this nailed down.”

The Capital One episode is a reminder of the intricacy of the computer networks at large financial institutions, as well as their vulnerability. Over the last several years, companies including Equifax and Morgan Stanley have been attacked with various hacking methods.

In some cases, the hackers have taken advantage of weak passwords or sent fake emails loaded with malicious computer code that helped them get inside the network. In others, they have scanned for software that hasn’t been kept up-to-date with the latest security fixes. Some hacks took hours. Others took months.

“The very best hackers in the world are hacking these banks, and it’s a full-fledged arms race,” said Tom Kellermann, the chief cybersecurity officer at Carbon Black, a security software maker.

By Stacy Cowley and

Read more at The New York Times

Advance your CPD minutes for this content, by signing up and using the CPD Wallet


You must be logged in to post a comment.

This site uses Akismet to reduce spam. Learn how your comment data is processed.