Capital One
Disclosed Feb 1, 20197 years ago106,000,000 affectedSettled
Cloud intrusion exposes data of 100 million US and 6 million Canadian applicants
Capital One said an outside individual obtained personal information on credit card applicants and customers, affecting about 100 million people in the US and 6 million in Canada, including about 140,000 Social Security numbers and 80,000 linked bank account numbers. A suspect was arrested.
What is known
| People affected | 106,000,000 (as reported by the organization) |
|---|---|
| Disclosed | Feb 1, 2019 |
| Discovered | Jul 19, 2019 |
| Happened | Mar 22, 2019 |
| Attack | Exposed data |
| Data exposed | Names, Addresses, Phone numbers, Dates of birth, Social Security numbers, Financial, Government IDs, Payment cards |
| Sector | Finance · US |
| Status | Settled |
| Lawsuit or fine | $80M OCC civil money penalty (2020) (about $80M) |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Capital Oneoag.ca.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: Capital Oneattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Capital Onejustice.oregon.gov · Official notice | Official notice |
| OCC Assesses $80 Million Civil Money Penalty Against Capital Oneocc.gov · Regulator | Regulator |
| Capital One Announces Data Security Incident (8-K Ex. 99.1)sec.gov · SEC filing | SEC filing |
| Indiana Attorney General 2021 data breach report: Capital Onein.gov · Official notice | Official notice |
| Indiana Attorney General 2020 data breach report: Capital Onein.gov · Official notice | Official notice |
| Indiana Attorney General 2019 data breach report: Capital Onein.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: Capital Onemaine.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Maine AGresidents of ME | Feb 1, 2019 | 8 |
| Indiana AGresidents of IN | Jul 10, 2019 | 2 |
| Researchtotal | Jul 29, 2019 | 106,000,000 |
| Delaware DOJresidents of DE | Aug 8, 2019 | 598 |
| Indiana AGresidents of IN | Aug 8, 2019 | 2,882 |
| California AGresidents of CA | Aug 12, 2019 | |
| Maine AGresidents of ME | Aug 12, 2019 | 5,438 |
| Indiana AGresidents of IN | Aug 20, 2019 | 21 |
| Maine AGresidents of ME | Aug 26, 2019 | 1 |
| California AGresidents of CA | Sep 11, 2019 | |
| Maine AGresidents of ME | Sep 11, 2019 | 1,213 |
| Oregon DOJresidents of OR | Sep 16, 2019 | |
| Maine AGresidents of ME | Oct 11, 2019 | |
| Indiana AGresidents of IN | Feb 4, 2020 | 10 |
| California AGresidents of CA | Mar 26, 2021 | |
| Indiana AGresidents of IN | Apr 20, 2021 | 3 |
Other breaches at Capital One
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Jan 12, 2026Jan 128 months ago | Jan 128 months ago | Not stated | Tech | Confirmed | 12 |
| Disclosed Apr 4, 2025Apr 4, 20251 year ago | Apr 4, 20251 year ago | Not stated | Tech | Confirmed | 1 |
| Disclosed Mar 20, 2023Mar 20, 20233 years agoRansomware | Mar 20, 20233 years ago | Ransomware | Finance | Confirmed | 17K |
| Disclosed Feb 6, 2020Feb 6, 20206 years ago | Feb 6, 20206 years ago | Not stated | Tech | Confirmed | 3,740 |
| Disclosed Feb 6, 2017Feb 6, 20179 years ago | Feb 6, 20179 years ago | Not stated | Tech | Confirmed | Unknown |
History of this record
- 2026-09-25 · disclosed: 2019-07-10 to 2019-02-01 · backfill source
- 2026-09-25 · data_types: ["names","addresses","phone","dob","ssn","financial","government-id"] to ["names","addresses","phone","dob","ssn","financial","government-id","payment-card"] · backfill source
- 2026-09-25 · disclosed: 2019-07-29 to 2019-07-10 · backfill source
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DecDataBreach.pdf · backfill source
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2020.pdf · backfill source
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/Data-Breach-Year-to-date-Report-2021-1.pdf · backfill source
- 2026-09-25 · status: confirmed to settled · seed source
- 2026-09-25 · fine_usd: empty to 80000000 · seed source
- 2026-09-25 · lawsuit: empty to $80M OCC civil money penalty (2020) · seed source
- 2026-09-25 · sector: tech to finance · seed source
- 2026-09-25 · attack: unknown to misconfiguration · seed source
- 2026-09-25 · data_types: ["names"] to ["names","addresses","phone","dob","ssn","financial","government-id"] · seed source
- 2026-09-25 · records_basis: empty to organization · seed source
- 2026-09-25 · records: empty to 106000000 · seed source
- 2026-09-25 · disclosed: 2019-08-08 to 2019-07-29 · seed source
- 2026-09-25 · summary: empty to Capital One said an outside individual obtained personal information on credit card applicants and customers, affecting about 100 million people in the US and 6 million in Canada, including about 140,000 Social Security numbers and 80,000 l · seed source
- 2026-09-25 · title: empty to Cloud intrusion exposes data of 100 million US and 6 million Canadian applicants · seed source
- 2026-09-25 · data_types: [] to ["names"] · backfill source
- 2026-09-25 · disclosed: 2019-08-12 to 2019-08-08 · backfill source
- 2026-09-25 · discovered: empty to 2019-07-19 · backfill source
- 2026-09-25 · disclosed: 2019-09-11 to 2019-08-12 · backfill source
- 2026-09-25 · disclosed: 2021-03-26 to 2019-09-11 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.