{
  "id": "case-paige-thompson-capitalone",
  "slug": "us-v-thompson-capital-one-breach",
  "title": "U.S. v. Paige Thompson (Capital One Cloud Breach)",
  "summary": "Former Seattle cloud engineer who identified misconfigured web application firewalls to gain unauthorized access to Capital One's Amazon Web Services storage buckets, exfiltrating 106 million customer credit card applications.",
  "case_number": "2:19-cr-00159",
  "court": "U.S. District Court for the Western District of Washington",
  "district": "W.D. Wash.",
  "country": "United States",
  "opened_at": "2019-07-29",
  "status": "convicted",
  "victim_sector": "Financial Services, Cloud Computing",
  "victim_country": "United States, Canada",
  "loss_amount_usd": 270000000,
  "loss_amount_note": "Capital One incurred $270 million in customer notifications, legal settlements, and regulatory fines.",
  "first_seen_at": "2019-03-01T00:00:00Z",
  "last_updated_at": "2026-09-04T11:00:00Z",
  "actor_slug": "erratic",
  "defendant_slugs": [
    "paige-thompson"
  ],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1190",
      "evidence_excerpt": "Thompson sent crafted HTTP requests exploiting a Server-Side Request Forgery (SSRF) flaw in a misconfigured open-source ModSecurity WAF.",
      "evidence_locator": "Indictment \u00b6 9, Page 4",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Indictment: U.S. v. Thompson",
      "source_url": "https://www.justice.gov/usao-wdwa/pr/former-seattle-tech-worker-convicted-wire-fraud-and-computer-intrusions",
      "technique_name": "Exploit Public-Facing Application",
      "tactic": "Initial Access"
    },
    {
      "technique_id": "T1078",
      "evidence_excerpt": "Obtained temporary security credentials from the AWS EC2 instance metadata service to access private S3 storage buckets.",
      "evidence_locator": "Trial Transcript Day 3, Page 54",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Trial Record",
      "source_url": "https://www.justice.gov/usao-wdwa/pr/former-seattle-tech-worker-convicted-wire-fraud-and-computer-intrusions",
      "technique_name": "Valid Accounts",
      "tactic": "Defense Evasion"
    },
    {
      "technique_id": "T1083",
      "evidence_excerpt": "Thompson ran automated aws-s3 listing commands to enumerate bucket contents across victim customer directories.",
      "evidence_locator": "Indictment \u00b6 12, Page 6",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Indictment: U.S. v. Thompson",
      "source_url": "https://www.justice.gov/usao-wdwa/pr/former-seattle-tech-worker-convicted-wire-fraud-and-computer-intrusions",
      "technique_name": "File and Directory Discovery",
      "tactic": "Discovery"
    }
  ],
  "events": [
    {
      "event_type": "arrest",
      "event_date": "2019-07-29",
      "description": "FBI agents arrest Thompson at her residence in Seattle."
    },
    {
      "event_type": "verdict",
      "event_date": "2022-06-17",
      "description": "Jury finds Thompson guilty of wire fraud and six counts of unauthorized access to a protected computer."
    },
    {
      "event_type": "sentencing",
      "event_date": "2022-10-04",
      "description": "Sentenced to time served and five years of supervised release with restitution ordered."
    }
  ]
}