In March 2019 an outsider took personal data on about 100 million people in the US and 6 million in Canada from Capital One systems. A researcher's report in July led the bank to find it. In August 2020 the OCC fined the bank 80 million dollars, citing weak risk assessment before a move to the public cloud.
What is the timeline?
The company's own incident page and the OCC release supply these dates.
- 22 and 23 March 2019: the unauthorised access took place.
- 17 July 2019: an external researcher reported a configuration vulnerability through the company's responsible disclosure programme.
- 19 July 2019: Capital One determined that an outside individual had obtained personal information on credit card customers and applicants.
- 6 August 2020: the OCC announced an 80 million dollar civil money penalty and a cease and desist order against the bank's subsidiaries.
- 27 January 2021: the company identified about 4,700 more US customers or applicants whose Social Security numbers were accessed.
- 7 February 2022: a federal court preliminarily approved a class action settlement.
The gap between the access in March and the discovery in July is the part defenders should sit with. About four months passed, and the trigger was an outside report, not an internal alert.
What data was involved?
The company lists applications from 2005 to early 2019 with names, addresses, dates of birth and self-reported income; credit scores, limits and balances; about 140,000 Social Security numbers and about 80,000 linked bank account numbers for secured card customers; and about 1 million Canadian Social Insurance Numbers. It states card account numbers and log-in credentials were not compromised.
What did the regulator say?
The OCC's stated grounds were that the banks failed to establish effective risk assessment processes before migrating significant IT operations to the public cloud, and failed to correct the deficiencies in a timely way. It called these unsafe or unsound practices and a violation of the interagency information security guidelines. It also gave positive weight to the notification and remediation work.
The OCC release does not describe the technical mechanism, and this post does not either, beyond the company's phrase "configuration vulnerability."
What can a team check this week?
- Review who and what can read each storage service, and remove broad roles from workloads that need narrow ones.
- Scan cloud accounts for misconfiguration continuously, not at audit time. A flaw that exists for months needs a detector that runs daily.
- Alert on unusual data volume leaving storage, such as a large listing and copy by an identity that rarely does so.
- Log control plane and data access events to an account the workload cannot alter.
- Run a risk assessment before each migration step, and record the decisions. This is the exact failing the regulator named.
- Publish a disclosure channel and monitor it. Here, a researcher's report is what ended the exposure.
- Rehearse notification. Know which data classes trigger which duty in which country.
Safeguard's compliance automation tracks control status against frameworks, which helps with item 2 and 5 as evidence, but it does not replace the architecture review those steps imply.
Quick check
How was the breach discovered?
Per Capital One, an external researcher reported a configuration vulnerability on 17 July 2019, and the company confirmed the data theft two days later.
Why was the bank fined?
The OCC cited failure to set up effective risk assessment before moving significant IT operations to the public cloud, and failure to fix deficiencies in time.
Sources
Last reviewed: 18 October 2026.
