Capital One Reports Data Breach Affecting 100 Million Customers, Applicants

Capital One Financial Corp. , the fifth-largest U.S. credit-card issuer, said Monday that a hacker accessed the personal information of approximately 106 million card customers and applicants, one of the largest-ever data breaches of a big bank.

Paige A. Thompson, 33 years old, was arrested in connection with the hack Monday by federal agents in Seattle, officials said. Ms. Thompson is accused of breaking through a Capital One firewall to access customer data that the bank had stored on Amazon.com Inc. ’s cloud service, according to a federal criminal complaint and people familiar with the matter.

The bulk of the exposed data involves information submitted by customers and small businesses that applied for Capital One credit cards between 2005 and early 2019, the bank said, including addresses, dates of birth and self-reported income.

Ms. Thompson is a former employee of Amazon Web Services Inc., according to people familiar with the matter. The criminal complaint says Ms. Thompson’s résumé showed she worked at a cloud-computing company, which the government didn’t name, as a systems engineer from 2015 to 2016.

A spokesman for Amazon didn’t immediately respond to a request for comment.

The breach compromised approximately 140,000 Social Security numbers and 80,000 bank account numbers, as well as some customers’ credit scores, payment histories and credit limits. It follows a breach in 2017 at credit-reporting company Equifax Inc., which exposed the data of nearly 150 million Americans and focused public and congressional attention on the sensitive information that financial companies keep on their customers.

The Capital One breach could prove to be damaging if criminals use the stolen information to apply for credit in the names of the most creditworthy or affluent people. Unlike most large U.S. card issuers, Capital One customers also include many subprime consumers.