Capital One Hacker Also Accused of Hacking 30 More Companies and CryptoJacking

An indictment unsealed on Wednesday revealed that Thompson not
just stole data from misconfigured servers hosted with a
cloud-computing company, but also used the computing power of
hacked servers to mine for cryptocurrency, a practice commonly
known as “Cryptojacking^[2].”

Thompson, known online as “erratic,” was arrested by the FBI on
July 29 concerning a massive breach in Capital One Financial Corp
that exposed the personal information of more than 100 million
credit card applicants in the United States and 6 million in
Canada.

The stolen data included approximately 140,000 Social Security
numbers and 80,000 bank account numbers linked to United States
customers, and 1 million Social Insurance numbers belonged to
Canadian citizens, along with some customers’ names, addresses,
dates of birth, credit scores, credit limits, balances, payment
history, and contact information.

Law enforcement became aware of Thompson’s activity after she
posted information relating to her theft of Capital One data on her
GitHub account.

While the indictment [PDF] did not
name the involved cloud-computing company, it’s highly likely to be
Amazon as Thompson previously worked for Amazon Web Services, which
provides cloud computing services to Capital One among others.
^[4]

But it should also be noted that Amazon Web Services was not
compromised in any way since Thompson gained access to the cloud
server due to Capital One’s misconfiguration and not through a
vulnerability in Amazon’s infrastructure.

The indictment also did not provide names of the other 30
victims, but it did describe three of the targeted organizations as
a state agency outside the State of Washington, a
telecommunications conglomerate outside the U.S. and a public
research university outside the State of Washington.

Investigators have found no evidence of Thompson selling or
disseminating any of the stolen information.

The 33-year-old Seattle-based software engineer remains in
custody and is scheduled to be arraigned on the indictment in U.S.
District Court in Seattle on September 5. She could face up to 25
years in prison if convicted.

^[1][3]