Former Amazon employee convicted of Capital One hack

Image Credit: Shutterstock (Image credit: Shutterstock)

An ex-Amazon Web Services (AWS) employee has been found guilty of multiple crimes in relation to one of the largest ever US data breaches.

According to a CNBC report, former AWS engineer Paige Thompson was found to have used her position within the firm to hack into Capital One’s database and steal sensitive information on more than 100 million people.

Using the alias “erratic”, she apparently built a tool that helped her search for misconfigured accounts on AWS. What she found was more than 30 such instances owned by Amazon clients, including Capital One. She then proceeded to mine that data and install cryptocurrency miners on some AWS servers.

Wire fraud, aggravated identity theft

The jury found Thompson guilty of seven federal crimes, including wire fraud, illegally accessing a protected computer, and damaging a protected computer. She was found not guilty of aggravated identity theft and access device fraud.

“She wanted data, she wanted money, and she wanted to brag,” Assistant United States Attorney Andrew Friedman said of Thompson, during closing arguments.

The sentencing is scheduled for September 15, and Thompson’s legal representative is yet to comment. Some of these crimes are punishable with up to 20 years of prison time

> Capital One hit by major data breach

> Capital One hack may have been bigger than thought

> Phishing attacks hit more businesses than ever last year

In mid-2019, financial giant Capital One revealed it suffered a major data breach, with around 106 million customers in the US and Canada having their personal details stolen, including names, addresses and phone numbers.

Around 140,000 US social security numbers and 80,000 linked bank account numbers are also thought to have been compromised, with about one million social insurance numbers belonging to Canadian credit card customers also affected.

Thompson was reported to police by a GitHub forum user after she apparently boasted of the attack online.

Capital One was faced with a class-action lawsuit, following the breach, and agreed to settle by paying $190 million, as well as an additional $80 million in regulatory fines.

Via CNBC

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.