Capital One

In 2025, Capital One experienced a significant data breach due to a misconfigured web application firewall (WAF). Attackers exploited this vulnerability to steal AWS credentials and access 100 million customer records. The breach highlighted critical gaps in regular WAF rule audits, enforcement of multi-factor authentication for privileged accounts, and real-time API activity monitoring. Post-incident, Capital One implemented Lacework's AI-driven anomaly detection, reducing false positives by 70% and halving response times.

Source: https://cybersecuritynews.com/cloud-misconfigurations/

TPRM report: https://scoringcyber.rankiteo.com/company/capital-one

"id": "cap721053025",
"linkid": "capital-one",
"type": "Breach",
"date": "5/2025",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '100 million',
                        'industry': 'Finance',
                        'name': 'Capital One',
                        'type': 'Financial Services'}],
 'attack_vector': 'Misconfigured Firewall',
 'data_breach': {'number_of_records_exposed': '100 million',
                 'type_of_data_compromised': 'Customer Records'},
 'date_detected': '2025',
 'description': 'Attackers exploited a misconfigured web application firewall '
                '(WAF) to steal AWS credentials, accessing 100 million '
                'customer records. The breach highlighted gaps in regular WAF '
                'rule audits, multi-factor authentication (MFA) enforcement '
                'for privileged accounts, and real-time API activity '
                'monitoring.',
 'impact': {'brand_reputation_impact': 'Reputational damage',
            'data_compromised': '100 million records',
            'financial_loss': '$4.35 million',
            'legal_liabilities': 'Regulatory penalties under GDPR and HIPAA'},
 'initial_access_broker': {'entry_point': 'Misconfigured WAF'},
 'lessons_learned': 'Regular WAF rule audits, MFA enforcement for privileged '
                    'accounts, real-time API activity monitoring',
 'motivation': 'Data Theft',
 'post_incident_analysis': {'corrective_actions': 'Implemented Lacework’s '
                                                  'AI-driven anomaly '
                                                  'detection, reducing false '
                                                  'positives by 70% while '
                                                  'halving response times.',
                            'root_causes': 'Misconfigured WAF'},
 'response': {'enhanced_monitoring': 'Real-time API activity monitoring',
              'remediation_measures': 'Implemented Lacework’s AI-driven '
                                      'anomaly detection, reducing false '
                                      'positives by 70% while halving response '
                                      'times.',
              'third_party_assistance': 'Lacework’s AI-driven anomaly '
                                        'detection'},
 'title': 'Capital One Firewall Misconfiguration (2025)',
 'type': 'Data Breach',
 'vulnerability_exploited': 'Misconfigured WAF'}