AccidentalFinancial ServicesFinanceMisconfigurationCustomer Data InvolvedFinancial accountPIILowResolved

Capital One Bank (USA), National Association

bd_76650af97c78342b · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jan 10, 2018

To disclose

—

Affected

1state residents only

Confidence

68%

Full breach record for Capital One Bank (USA), National Association →5 incidents on file

Capital One, N.A. notified Montana residents that a misconfiguration allowed an unauthorized customer to view another customer's online account information, including account numbers, routing numbers, balances, and transaction history. Capital One removed access, offered two years of TransUnion credit monitoring, and determined the root cause to prevent recurrence.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Jan 10, 2018

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Capital One Bank (USA), National Association
norm: capital one bank usa national
Domain: capitalone.com

Name: Capital One Bank (USA), National Association
norm: capital one bank usa national
Domain: capitalone.com
Industry: Financial Servicesllm

Discovered: —
Materiality determined: —
Notification sent: Jan 10, 2018
Affected individuals: 1state-resident count only
Data types: Financial accountPII
Attack vector: Misconfiguration
MITRE ATT&CK: T1078 Valid Accounts

During the incident: Removed this person’s ability to review the account online
Arranged for you to enroll, at no cost to you, in an online three-bureau credit monitoring service (My TransUnion Monitoring) for two years
Provided up to $1,000,000 in identity theft insurance with no deductible
Enclosed fraud prevention tools and tips
Changes made: Determined the root cause of this problem
Taken appropriate steps to prevent it from happening in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Capital-One-Bank.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2018
Raw hash: fd2dcb61f2126f7581d552eec2d06992a15849ae4a8318e41d8124f1d4081997

Reporting entityCapital One Bank (USA), National Association

Victim entityCapital One Bank (USA), National Association

IncidentMisconfiguration

Stated responseRemoved this person’s ability to review the account online

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov