Every public data breach

Disclosed this week44On record26,355

44 disclosed this week · 26,355 on record

Capital One

Disclosed Feb 1, 2019106,000,000 affectedSettled

Official notice

Cloud intrusion exposes data of 100 million US and 6 million Canadian applicants

Capital One said an outside individual obtained personal information on credit card applicants and customers, affecting about 100 million people in the US and 6 million in Canada, including about 140,000 Social Security numbers and 80,000 linked bank account numbers. A suspect was arrested.

What is known

People affected106,000,000 (as reported by the organization)
DisclosedFeb 1, 2019
DiscoveredJul 19, 2019
HappenedMar 22, 2019
AttackExposed data
Data exposedNamesAddressesPhone numbersDates of birthSocial Security numbersFinancialGovernment IDsPayment cards
SectorFinance · US
StatusSettled
Lawsuit or fine$80M OCC civil money penalty (2020) (about $80M)

Sources

Official noticeoag.ca.gov
California Attorney General breach notice: Capital One
Official noticeattorneygeneral.delaware.gov
Notice letter filed with the Delaware DOJ: Capital One
Official noticejustice.oregon.gov
Oregon DOJ breach notice: Capital One
Regulatorocc.gov
OCC Assesses $80 Million Civil Money Penalty Against Capital One
SEC filingsec.gov
Capital One Announces Data Security Incident (8-K Ex. 99.1)
Official noticein.gov
Indiana Attorney General 2021 data breach report: Capital One
Official noticein.gov
Indiana Attorney General 2020 data breach report: Capital One
Official noticein.gov
Indiana Attorney General 2019 data breach report: Capital One
Official noticemaine.gov
Maine Attorney General breach notice archive: Capital One

Notices filed

Residents of MEFeb 1, 2019
Maine AG8 people
Residents of INJul 10, 2019
Indiana AG2 people
TotalJul 29, 2019
Research106,000,000 people
Residents of DEAug 8, 2019
Delaware DOJ598 people
Residents of INAug 8, 2019
Indiana AG2,882 people
Residents of CAAug 12, 2019
California AGCount not stated
Residents of MEAug 12, 2019
Maine AG5,438 people
Residents of INAug 20, 2019
Indiana AG21 people
Residents of MEAug 26, 2019
Maine AG1 person
Residents of CASep 11, 2019
California AGCount not stated
Residents of MESep 11, 2019
Maine AG1,213 people
Residents of ORSep 16, 2019
Oregon DOJCount not stated
Residents of MEOct 11, 2019
Maine AGCount not stated
Residents of INFeb 4, 2020
Indiana AG10 people
Residents of CAMar 26, 2021
California AGCount not stated
Residents of INApr 20, 2021
Indiana AG3 people

Other breaches at Capital One

Breach, details not statedBreach notice filed with the Indiana AG, details not stated.12 affectedTechUSJan 12Breach, details not statedBreach notice filed with the Indiana AG, details not stated.1 affectedTechUSApr 4, 2025Ransomware breachRansomware, data exposed not stated. Reported to the Indiana AG.17K affectedFinanceUSMar 20, 2023Breach, details not statedExposed names, payment cards, financial details and Social Security numbers. Reported to the Indiana AG.3,740 affectedTechUSFeb 6, 2020Breach, details not statedBreach notice filed with the California AG, details not stated.TechUSFeb 6, 2017
History of this record
disclosed2026-09-25
2019-07-10 to 2019-02-01by backfillSource
data_types2026-09-25
["names","addresses","phone","dob","ssn","financial","government-id"] to ["names","addresses","phone","dob","ssn","financial","government-id","payment-card"]by backfillSource
disclosed2026-09-25
2019-07-29 to 2019-07-10by backfillSource
source2026-09-25
empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DecDataBreach.pdfby backfillSource
source2026-09-25
empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2020.pdfby backfillSource
source2026-09-25
empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/Data-Breach-Year-to-date-Report-2021-1.pdfby backfillSource
status2026-09-25
confirmed to settledby seedSource
fine_usd2026-09-25
empty to 80000000by seedSource
lawsuit2026-09-25
empty to $80M OCC civil money penalty (2020)by seedSource
sector2026-09-25
tech to financeby seedSource
attack2026-09-25
unknown to misconfigurationby seedSource
data_types2026-09-25
["names"] to ["names","addresses","phone","dob","ssn","financial","government-id"]by seedSource
records_basis2026-09-25
empty to organizationby seedSource
records2026-09-25
empty to 106000000by seedSource
disclosed2026-09-25
2019-08-08 to 2019-07-29by seedSource
summary2026-09-25
empty to Capital One said an outside individual obtained personal information on credit card applicants and customers, affecting about 100 million people in the US and 6 million in Canada, including about 140,000 Social Security numbers and 80,000 lby seedSource
title2026-09-25
empty to Cloud intrusion exposes data of 100 million US and 6 million Canadian applicantsby seedSource
data_types2026-09-25
[] to ["names"]by backfillSource
disclosed2026-09-25
2019-08-12 to 2019-08-08by backfillSource
discovered2026-09-25
empty to 2019-07-19by backfillSource
disclosed2026-09-25
2019-09-11 to 2019-08-12by backfillSource
disclosed2026-09-25
2021-03-26 to 2019-09-11by backfillSource
Added2026-09-25
First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Capital One