Not to say, I told you so, but around the same time that the Capital One data breach occurred, I was reminding clients that nearly half of all significant data breaches or cyber-incidents occur because of internal actors. Internal actors can act with intent or negligence and cause devastating harm – e.g. clicking on a phishing email, deliberately stealing important data or failing to secure a person’s computer. Because of this basic fact, compliance should play a significant role in mitigating cyber and data breach risks – compliance officers are good at assessing a risk, designing controls to mitigate the risk, and then measuring the performance of the compliance program.
Capital One suffered a serious data breach not because of some hooded cyber-junky sitting in Eastern Europe or some sophisticated electronic attack – no, Capital One suffered a data breach because of one bad actor, Paige Thompson.
On July 29, 2019, FBI agents arrested Paige Thompson for downloading nearly 30 GB of 100 million Capital One Financial Corporation credit applications from an Amazon cloud data server. Capital One learned about the theft from a July 17, 2019 email noting that some of the leaked data was being stored for public view on the software development platform Github. The account owner was a user “Netcrave,” which included Paige Thompson’s resume. According to the FBI, Thompson also used a public meetup group where she invited others to join a Slack channel.
For compliance and cyber officials, the Capital One underscores the risks that companies face when relying on third-party vendors, in this case Amazon, for ..
Support the originator by clicking the read the rest link below.
