Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Financial accountLowActive

Capital One, National Association

bd_bfab2a82648ffa2e · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Sep 22, 2017

To disclose

—

Affected

1state residents only

Confidence

68%

All records for Capital One, National Association →24 incidents on file

Account takeover notice

Capital One, National Association notified customers of unauthorized access to their accounts. The filing says: “As we have discussed with you recently, someone made or attempted to make unauthorized transactions on your Capital One account(s) by signing in with your username and password, which we believe were stolen from one of these websites.”

Capital One issued a supplemental notice to Montana residents regarding unauthorized account access via stolen credentials obtained through phishing. The fraudster accessed names, addresses, account numbers, and transaction history. Capital One locked accounts, reset passwords, and provided two years of TransUnion credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Sep 22, 2017

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Capital One, National Association
norm: capital one national

Name: Capital One, National Association
norm: capital one national
Industry: Financial Servicesllm

Discovered: —
Materiality determined: —
Notification sent: Sep 21, 2017
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Phishing
MITRE ATT&CK: T1078 Valid AccountsT1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Locked online access to your account(s)
Providing two years of free credit monitoring and identity protection with TransUnion's credit monitoring service
Changes made: Providing two years of free credit monitoring and identity protection with TransUnion's credit monitoring service
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Capital-One-3-1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 22, 2017
Raw hash: 9ab03b28d03f441d80e5b25404dfe501551fd2400e3c2ac592e934e41348da43

Reporting entityCapital One, National Association

Victim entityCapital One, National Association

IncidentPhishing

Stated responseLocked online access to your account(s)

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov