Capital One Financial Corp said on Monday that a hacker has obtained personal information including names and addresses of about 100 million individuals in the United States and 6 million people in Canada.
Capital One said the cyber security incident is expected to cost between $100 million and $150 million in 2019, mainly because of customer notifications, credit monitoring and legal support.
Capital One said the female hacker did not gain access to credit card account numbers. She accessed about 140,000 Social Security numbers and 80,000 linked bank account numbers. The hacker also accessed other personal information accessed included phone numbers and credit scores.
The hacker also accessed about 1 million social insurance numbers of the company’s Canadian credit card customers.
The Capital One hacker was able to gain access to the data through a misconfigured web application firewall, the U.S. Attorney’s office said.
The suspect, a 33-year-old former Seattle technology company software engineer identified as Paige Thompson, made her initial appearance in U.S. District Court in Seattle on Monday, the U.S. Attorney’s office said.
According to a complaint filed in the District Court for the Western District of Washington at Seattle, Thompson posted information from her hack, which occurred between March 12 and July 17, on coding platform GitHub. Another user saw the post and notified Capital One of the breach.
Law enforcement officials were able to track Thompson down as the page she posted on contained her full name as part of its digital address, the complaint said. Capital One said it identified the hack on July 19, Reuters reported.
Credit-reporting company Equifax said last week it would pay up to $700 million to settle claims it broke the law during a 2017 data breach when roughly 147 million people had information, including Social Security numbers and driver’s license data, compromised.