CASE DOSSIER convicted

U.S. v. Paige Thompson (Capital One Cloud Breach)

Docket: 2:19-cr-00159 Court: U.S. District Court for the Western District of Washington Opened: 2019-07-29 Sector: Financial Services, Cloud Computing

Key Facts

Status

CONVICTED

Legal disposition

Loss Amount

$270.0 million

Capital One incurred $270 million in customer notifications, legal settlements, and regulatory fines.

Techniques

Verified mappings

Defendants

Named in charges

Legal Status: CONVICTED in U.S. District Court for the Western District of Washington.
Primary Target Sector: Financial Services, Cloud Computing.
Documented Financial Loss: $270.0 million.
3 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.

Export structured case data and MITRE ATT&CK Navigator layer:

Download Navigator Layer (JSON) Case Data (JSON)

Case Summary

Former Seattle cloud engineer who identified misconfigured web application firewalls to gain unauthorized access to Capital One's Amazon Web Services storage buckets, exfiltrating 106 million customer credit card applications.

BOARDROOM EXECUTIVE BRIEF

Executive Summary for Board Members & Leadership

Plain-English Root Cause

Adversary breached the target network via Exploit Public-Facing Application. Thompson sent crafted HTTP requests exploiting a Server-Side Request Forgery (SSRF) flaw in a misconfigured open-source ModSecurity WAF.

Operational & Financial Fallout

Capital One incurred $270 million in customer notifications, legal settlements, and regulatory fines. Impacted Financial Services, Cloud Computing infrastructure and associated victim operations.

3 Critical Boardroom Questions

1. Do 100% of our external portals enforce phishing-resistant hardware MFA?
2. Can compromised endpoint credentials traverse laterally to domain controllers or cloud storage?
3. Have our air-gapped immutable recovery backups been restored and tested within the last 90 days?

Disposition: CONVICTED

Technical Threat Intelligence

Attack Anatomy & Incident Execution

Forensic analysis of initial intrusion vector, step-by-step kill chain, operational blast radius, and defensive controls.

Ground Zero / Infiltration Vector

Adversary Kill Chain Flow

3 Documented Phases

Phase 1: Initial Access Initial Perimeter Infiltration

MITRE ATT&CK T1190 →

Thompson sent crafted HTTP requests exploiting a Server-Side Request Forgery (SSRF) flaw in a misconfigured open-source ModSecurity WAF.

Artifacts & Tooling: T1190 Exploit Public-Facing Application

Phase 2: Defense Evasion Defense Evasion & Security Blindfolding

MITRE ATT&CK T1078 →

Obtained temporary security credentials from the AWS EC2 instance metadata service to access private S3 storage buckets.

Artifacts & Tooling: T1078 Valid Accounts

Phase 3: Discovery Internal Subnet & Trust Reconnaissance

MITRE ATT&CK T1083 →

Thompson ran automated aws-s3 listing commands to enumerate bucket contents across victim customer directories.

Artifacts & Tooling: T1083 File and Directory Discovery

Real-World Blast Radius & Operational Fallout

Capital One incurred $270 million in customer notifications, legal settlements, and regulatory fines. Impacted Financial Services, Cloud Computing infrastructure and associated victim operations.

Defensive Engineering Takeaways

Recommended Hardening Controls

✓ Enforce phishing-resistant multifactor authentication (FIDO2) across all external remote access endpoints.

✓ Implement network microsegmentation to prevent unrestricted lateral traversal between internal subnets.

✓ Maintain isolated, immutable backups of critical directory services and transaction databases.

✓ Deploy real-time endpoint detection and response (EDR) agents with automated containment policies.

Procedural & Incident Timeline

2019-07-29 arrest

FBI agents arrest Thompson at her residence in Seattle.

2022-06-17 verdict

Jury finds Thompson guilty of wire fraud and six counts of unauthorized access to a protected computer.

2022-10-04 sentencing

Sentenced to time served and five years of supervised release with restitution ordered.

Named Defendants & Operatives

Defendant	Nationality	Status	Prison Term	Restitution	Notes
Paige Adele Thompson	United States	convicted	Pending	None	Perpetrator of Capital One cloud data breach; convicted of wire fraud and computer intrusion.

Substantiated MITRE ATT&CK Techniques

Technique ID	Technique Name & Tactic	Primary Source Evidence Excerpt	Locator	Verification
T1190	Exploit Public-Facing Application Initial Access	"Thompson sent crafted HTTP requests exploiting a Server-Side Request Forgery (SSRF) flaw in a misconfigured open-source ModSecurity WAF."	Indictment ¶ 9, Page 4	reviewed
T1078	Valid Accounts Defense Evasion	"Obtained temporary security credentials from the AWS EC2 instance metadata service to access private S3 storage buckets."	Trial Transcript Day 3, Page 54	reviewed
T1083	File and Directory Discovery Discovery	"Thompson ran automated aws-s3 listing commands to enumerate bucket contents across victim customer directories."	Indictment ¶ 12, Page 6	reviewed

Cite & Embed This Case Record

Public Domain / CC0

Bluebook Legal Citation:

Cyberattack Case Library, U.S. v. Paige Thompson (Capital One Cloud Breach), No. 2:19-cr-00159 (U.S. District Court for the Western District of Washington 2019), https://cybercaselibrary.com/cases/us-v-thompson-capital-one-breach/

Embeddable Incident Card (HTML):