Capital One data breach involving cloud-hosted data and subsequent OCC penalty
Capital One announced a data security incident involving unauthorized access to personal information and certain credit card application data. The company provided details on timing and affected populations and engaged law enforcement. The U.S. Office of the Comptroller of the Currency (OCC) later assessed an $80 million civil money penalty related to the incident, reflecting significant regulatory financial impact.
First reported July 29, 2019Breachhigh overall confidence
Cited disclosures focus on incident facts and enforcement outcomes; attribution is addressed in court processes not summarized here.
CVEs and ATT&CK
No CVE or ATT&CK association is captured in this curated record.
Mitigations
Now
Harden cloud perimeter controls (WAF rules, metadata protections, least privilege IAM)Reduces risk of cloud-hosted data exposure from misconfigurations and application-layer weaknesses.
Soon
Centralize cloud audit logging and enforce retention for forensic readinessImproves detection and investigation of anomalous access to cloud data stores.
Later
Continuously test cloud controls (penetration testing, config scanning, red teaming)Finds exploitable paths and misconfigurations before adversaries do.
Detection ideas
Detect anomalous reads/downloads from cloud object storage and databases
Alert on high-volume reads, new principals accessing sensitive buckets, or access from unfamiliar IPs/ASNs.
Data sources: Cloud audit logs (e.g., AWS CloudTrail), Data access logs, SIEM
Detect WAF bypass or abnormal request patterns to internet-facing applications
Correlate spikes in blocked/allowed requests, unusual paths/headers, and error rates with subsequent anomalous data access.
Data sources: WAF logs, Reverse proxy logs, Web server access logs
