Former Amazon Employee Indicted For Hacking Capital One’s Network, Swiping People’s Data

A former Amazon software engineer was indicted Wednesday for stealing sensitive data from Capital One, a move affecting millions of Americans.

Paige Thompson was charged with wire fraud, as well as computer fraud and abuse for hacking into Capital One’s network. Thompson, who is a transgender male living in Seattle, faces nearly 25 years in prison if convicted. The crime has implications beyond those affecting Capital One’s customers.

Thompson was arrested in July for allegedly stealing personal information from more than 100 million U.S. Capital One customers, including Social Security numbers, as well as the data of an additional 6 million Canadians. Thompson’s arrest came after the former engineer posted on GitHub about the theft.

The indictment alleges Thompson used “scanning software” to obtain the stolen data — the software allowed Thompson to identify the customers of an unnamed cloud computing company that had “misconfigured their firewalls.” Thompson allegedly used stolen power from the computers accessed to “mine cryptocurrency for her own benefit.”

Amazon stored the 106 million Capital One credit-card records. Capital One blamed the incident on “a specific configuration vulnerability” in the way it uses Amazon’s cloud. The Wall Street Journal reported on Aug. 7 how the accused hacker was allegedly able to exploit a weakness in some misconfigured networks that cloud security experts frequently warn about.

The company has not responded to the Daily Caller News Foundation’s request for comment about Thompson’s indictment, nor has the company addressed questions about the so-called misconfigured networks.

Capital One estimated that 14,000 Social Security numbers of credit card customers were accessed while 80,000 bank account numbers were compromised. The theft comes as Amazon is angling to land a $10 billion cloud computing program with the Department of Defense.

Defense Secretary Mark Esper is now reviewing accusations of unfairness in the contract process for the program, known as Joint Enterprise Defense Infrastructure (JEDI), the Pentagon announced on Aug. 1. His decision came after President Donald Trump ratcheted up criticism of the project. Amazon and Microsoft are the only two finalists.