What You Need to Know About the Capital One Data Breach
Consumer Reports has no financial relationship with advertisers on this site.
Consumer Reports has no financial relationship with advertisers on this site.
A hacker gained access to around 100 million Capital One customer accounts and credit card applications this spring, according to the credit card giant, giving consumers yet another reason to lock down their credit.
According to the company, most of the information came from consumers and small businesses that applied for Capital One credit cards from 2005 through early 2019. The information on the applications included extremely sensitive personal information including names, addresses, ZIP codes, phone numbers, email addresses, birth dates, and self-reported income.
Capital One says its initial analysis indicates that the data wasn't disseminated or used for fraud.
Beyond the credit card application data, the hacker also obtained customer data including credit scores, credit limits, balances, payment history and contact information, as well as some transaction data from a total of 23 days during 2016, 2017, and 2018.
Capital One added that about 140,000 Social Security numbers belonging to credit card customers were also compromised, along with the linked bank account numbers of about 80,000 secured credit card customers. The breach also affects about six million Capital One customers in Canada.
No credit card numbers or log-in credentials were compromised in the breach, according to Capital One.
The company has said that it will notify affected consumers but didn't specify how those notifications would be delivered. The company said it will make free credit monitoring and identity protection available to everyone affected.
What You Should Do
The personal nature of the information stolen puts consumers at risk for an increasingly popular form of identity theft. "This is very concerning because sensitive information like bank account numbers and Social Security numbers were disclosed and they can be used to create new accounts," says Maureen Mahoney, a policy analyst for Consumer Reports.
Mahoney notes that new account fraud is on the rise, with U.S. consumers losing $3.4 billion in 2018, up from $3 billion in 2017, according to a study by the research firm Javelin. "It's also one of the most difficult types of fraud to detect and resolve," she adds.
Mahoney advises consumers to immediately place credit freezes with each of the three major credit reporting bureaus—Equifax, Experian, and TransUnion—to prevent cyber thieves from opening new accounts without the consumer's knowledge.
Credit freezes—as well as the temporary lifting of a freeze when you need to apply for a loan or a mortgage—are free but used to carry a small charge.
She also suggests that in addition to monitoring your bank and credit card statements, you should regularly check your credit reports and report any unusual or suspicious activity immediately.
Late Reporting, an Early Arrest
The Capital One breach is unusual in the speed with which the alleged perpetrator was apprehended and the incident was reported to the public.
The FBI has arrested Paige Thompson, 33, a software engineer in Seattle. The bank called her "a highly sophisticated individual [who] was able to exploit a specific configuration vulnerability in our infrastructure." Thompson, who used the online handle "erratic," was caught after she posted about her exploits on Slack and the information sharing site GitHub.
"Capital One had no idea that someone inappropriate had accessed huge amounts of sensitive data until the attacker bragged about it in Slack?" asks Brian Vecci, field CTO of Varonis, a security firm. "It’s likely that if Capital One had been monitoring this data in the right ways that they’d have seen unusual access and been able to take action even sooner."
The company reported a similar breach in 2014, when an employee gained unauthorized access to consumer accounts.
"While I am grateful that the perpetrator has been caught, I am deeply sorry for what has happened," said Richard D. Fairbank, chairman and CEO, in a press release. "I sincerely apologize for the understandable worry this incident must be causing those affected and I am committed to making it right."
Capital One estimated the costs to the company at between $100 to $150 million. "Consumers should rightfully be asking why an apparently major data breach only costs the offending company at most about a dollar fifty per affected customer," says Vecci. "If the costs of exposing personal information are small enough to not matter, there’s no incentive for companies like Capital One to do more to protect data."
The company took 10 days to report the incident to the public. That's much quicker than the Equifax breach in which a vulnerability was discovered in late July 2017, but not disclosed to consumers until early September.
The vulnerability was reported to Capital One by an external security researcher on July 17, 2019. The credit card company says began its own internal investigation and confirmed the information on July 19, 2019, and the reported it to the FBI. The breach occurred on March 22 and 23 of this year, according to the company.
Consumer advocates cite the breach as a call for tough legislation that would compel companies to protect consumer data more carefully.
"There need to be strong laws requiring companies to keep data secure," says CR's Mahoney. "With strong enforcement to make sure they actually comply."
Correction: In a previous version of this article, two typos made reference to Credit One. In these cases, Consumer Reports intended to refer to Capital One. Additionally, we reported that Paige Thompson was a former Capital One software engineer. She was not employed by the company.
More from Consumer Reports:
Top pick tires for 2016
Best used cars for $25,000 and less
7 best mattresses for couples
Consumer Reports is an independent, nonprofit organization that works side by side with consumers to create a fairer, safer, and healthier world. CR does not endorse products or services, and does not accept advertising. Copyright © 2019, Consumer Reports, Inc.
