Capital One cloud breach and an $80 million OCC penalty for weak cloud-migration risk assessment (2019)
The OCC assessed an $80 million civil money penalty against Capital One for failing to establish effective risk assessment processes before migrating significant IT operations to the public cloud and for not correcting…
What happened
- The OCC assessed an $80 million civil money penalty against Capital One for failing to establish effective risk assessment processes before migrating significant IT operations to the public cloud and for not correcting deficiencies in a timely manner.OCC Assesses $80 Million Civil Money Penalty Against Capital One
- Misconfigured ModSecurity WAF exploited via SSRF to query IMDSv1; exfiltrated 700 S3 buckets containing 106M credit card applications.Summary combines the linked source with wider public reporting
The failure pattern
Watch the pattern: Known vulnerability left unremediated
Safeguards that address it
CollectSEA's engineering analysis of what would have prevented or contained this failure.
- Assess cloud risk before migrating, and fix findings on timeComplete risk assessment and network-security control design before moving workloads, then track remediation of deficiencies.
- Restrict cloud metadata and role permissionsRequire metadata-service protections, least-privilege roles for edge components, and alerting on unusual bulk reads of storage.
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
- ASI03 Identity and Privilege Abuse
- LLM03 Excessive Agency
- AC-3 Access Enforcement
- AC-5 Separation of Duties
- AC-6 Least Privilege
- RA-5 Vulnerability Monitoring and Scanning
- SI-2 Flaw Remediation
- RV.1.1 Gather vulnerability information from public sources
- RV.2.2 Plan and implement risk responses
- RV.3.4 Update the development process
- MAP 5.1 Estimate impacts from past uses and public incident reports
- Goal 4 Security patches
- CWE-862 Missing Authorization
- CWE-1395 Dependency on Vulnerable Third-Party Component
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
"ToolShell" vulnerabilities in on-premises SharePoint are exploited to steal server keys (2025)
Microsoft observed attackers exploiting on-premises SharePoint Server vulnerabilities (CVE-2025-53770 and CVE-2025-53771, related to CVE-2025-49704 and CVE-2025-49706) against internet-facing servers, with attempts as…
SQL injection in MOVEit Transfer exploited by the CL0P ransomware gang (2023)
CISA and the FBI report that the CL0P ransomware gang exploited a SQL injection vulnerability (CVE-2023-34362) in Progress MOVEit Transfer beginning May 27, 2023, installing a web shell called LEMURLOOT.
Log4Shell: remote code execution through JNDI lookups in Apache Log4j (2021)
CVE-2021-44228 (Log4Shell) affects Apache Log4j 2.0-beta9 through 2.14.1 and lets an unauthenticated remote actor execute arbitrary code through JNDI lookups.
Unpatched web-application vulnerability (Apache Struts) leads to the Equifax breach (2017)
Apache Struts CVE-2017-5638 parser bug left unpatched for 2 months; attackers executed arbitrary commands and accessed unencrypted databases of 147M Americans.
F5, Inc. discloses a cybersecurity incident with data taken without authorization (SEC 8-K, October 2025)
On August 9, 2025, F5, Inc. (the “Company”, “F5”, “we”, or “our”) learned that a highly sophisticated nation-state threat actor had gained unauthorized access to certain Company systems.
GitHub Actions injection leaks Nx's npm token; malicious packages use local AI coding tools to hunt for secrets (2025)
A pull-request title validation workflow used pullrequesttarget, which runs with repository secrets, and echoed the unsanitized PR title, creating an injection point; the workflow's token also had read/write permissions.