By: Ella Wang

Last Friday, a former Amazon worker was accused of hacking into Capital One and stealing information of more than 100 million people almost three years ago in one of the largest data breaches in America.

Paige Thompson was convicted of seven federal crimes, including wire fraud. These punishable crimes have led to up to 20 years in prison. The other charges including illegally accessing a protected computer and damaging a protected computer, also add an extra five years to Thompson’s sentence.

Thompson’s Capital One Hack in 2019 was one of the largest breaches in the United States, which exposed the names, birth dates, social security numbers, email addresses, and phone numbers of over 100 million people in the U.S. and Canada.

In December 2020, Capital One agreed to pay $190 million to those whose data has been exposed. Additionally, the bank agreed to pay $80 million in regulatory fines. The breach exposed about 120,000 social security numbers and around 77,000 bank account numbers, according to the complaint.

According to an article in the New York Times, Thompson’s lawyers claimed that she was looking for cracks and problems in security so they could be fixed. Earlier this year, under the Computer Fraud and Abuse Act, the Justice Department announced that it would not prosecute people for security research, which is what Thompson claimed to have been doing. However, US prosecutors were not convinced that her actions fell under this exception.

The Justice Department states Thompson developed a tool to gain access to the systems of Capital One and dozens of other Amazon customers. Prosecutors also said that Thompson hacked companies’ servers to install cryptocurrency mining software that would transfer any earnings to her personal crypto wallet. “She wanted data, she wanted money, and she wanted to brag,” said Andrew Friedman, an assistant U.S. attorney to The New York Times.

In addition to the bragging, Thompson posted the sensitive customer data to a public GitHub site and shared the process of her breach to numerous social media platforms, including Twitter and Slack.

“Ms. Thompson used her hacking skills to … hijacked computer servers to mine cryptocurrency,” said Nicholas W. Brown, the U.S. attorney for the Western District of Washington to The New York Times’s Kate Conger. “Far from being an ethical hacker trying to help companies with their computer security, she exploited mistakes to steal valuable data and sought to enrich herself.”

U.S. District Judge Robert S. Lasnik set Thompson’s sentencing for September 15, 2022.

Link to articles:

https://www.nytimes.com/2022/06/17/technology/paige-thompson-capital-one-hack.

html https://www.cnbc.com/2022/06/18/former-amazon-employee-convicted-in-capital-on e-hack.html https://www.theverge.com/2022/6/18/23173727/former-amazon-employee-convicted- over-2019-capital-one-hack-paige-thompson