Source: GlobeNewswire. Original press release dated August 30, 2019.
Overview
Houston-based law firm Emerson Firm, PLLC announced on August 30, 2019 that it had filed a class action lawsuit in the United States District Court, Western District of Washington at Seattle, on behalf of more than 100 million Capital One customers in the United States whose personal and financial information was compromised in a major data breach. The breach was publicly disclosed by Capital One on July 29, 2019, and has been described as one of the largest data breaches ever to affect a financial services company.
The case is formally styled Amjed Ali Ababseh v. Capital One Financial Corporation, Capital One, N.A., Capital One Bank (USA), N.A., Amazon.com, Inc., Amazon Web Services, Inc., and GitHub, Inc., Civil Action No. 2:19-cv-1397.
What Happened: The Capital One Data Breach
Capital One is a major US bank holding company specializing in credit cards, auto loans, and consumer bank accounts. In the course of its business, Capital One collects extensive personal and financial information from customers and applicants, including Social Security numbers, credit scores, and account details.
According to Capital One’s disclosure, a hacker gained unauthorized access to customer data that Capital One had stored on Amazon Web Services (AWS) infrastructure. The stolen data was subsequently posted publicly on GitHub.com, making it accessible to anyone on the internet. The alleged perpetrator was identified as a former Amazon employee.
Who Is Named in the Lawsuit and Why
The lawsuit names three groups of defendants, each facing distinct allegations:
- Capital One (Capital One Financial Corporation, Capital One N.A., and Capital One Bank USA N.A.): As the entity that collected and was responsible for safeguarding customer data, Capital One faces allegations related to its failure to adequately protect sensitive information entrusted to it by customers and applicants.
- Amazon (Amazon.com, Inc. and Amazon Web Services, Inc.): The complaint alleges that the Amazon defendants failed to take adequate and reasonable measures to secure their cloud infrastructure and data systems against unauthorized access, contributing to the conditions that enabled the breach.
- GitHub, Inc.: GitHub is named in connection with the stolen data being posted and made publicly available on its platform.
Who May Be Affected
According to Emerson Firm, PLLC, any person who held a Capital One account or applied for a Capital One product since 2005 may have had their data compromised in this breach. The class is national in scope, and the firm states that affected individuals may seek relief regardless of which US state they reside in.
About the Plaintiff’s Legal Counsel
The plaintiff is represented by Emerson Firm, PLLC, a Houston, Texas-based law firm with additional offices in Little Rock, Arkansas. According to the firm, it and its predecessor firms have focused on complex commercial litigation for more than 38 years and have collectively recovered more than one billion dollars for consumers through class action litigation across the United States.
DevOps and Cloud Security Context
For DevOps and cloud engineering teams, this case is a significant reminder of the legal and business risks associated with misconfigured cloud environments. The Capital One breach was attributed to a misconfigured Web Application Firewall (WAF) on AWS, which allowed the attacker to exploit a Server-Side Request Forgery (SSRF) vulnerability and access IAM credentials — ultimately enabling bulk data access from S3 buckets.
Key security lessons highlighted by incidents like this one include:
- Principle of least privilege: IAM roles and service accounts should be scoped to the minimum permissions required. Over-permissioned roles dramatically increase the blast radius of a compromise.
- SSRF protections: Cloud-hosted applications should be hardened against SSRF attacks, which can be used to query internal metadata endpoints and steal credentials.
- Secrets and code hygiene on GitHub: Developers and organizations should enforce policies preventing sensitive data, credentials, or customer information from being committed or posted to public repositories.
- Cloud security posture management (CSPM): Continuous automated scanning of cloud configurations can detect misconfigurations before they are exploited.
- Incident response planning: Organizations storing regulated data must have clear, tested breach response procedures, including data notification obligations under applicable law.
The inclusion of AWS and GitHub as named defendants in this litigation underlines that cloud providers and platform operators are increasingly subject to legal scrutiny when their platforms are involved in data exposure events, even where the root misconfiguration originates with the customer.
Source
This article is based on a press release published by Emerson Firm, PLLC via GlobeNewswire on August 30, 2019.