Echo — Capital One (2019)

What happened

In July 2019, Capital One disclosed one of the largest data breaches in banking history. An attacker exploited a Server-Side Request Forgery (SSRF) flaw in a misconfigured web application firewall running in Capital One's cloud environment, then used that foothold to reach credit-card application data for roughly 100 million people in the United States and about 6 million in Canada. The intrusion had happened months earlier and was only caught after a tip; the attacker had already copied the data to their own systems.

The mechanism

The failure was not the firewall bug alone — it was what the stolen identity could reach. The SSRF let the attacker make the compromised server request its own cloud instance metadata endpoint, which handed back temporary credentials for the IAM role the firewall ran as. That role was scoped far wider than a firewall ever needed: it could list and read the storage buckets holding Capital One's application data. So a single web-layer flaw converted directly into "list every bucket, then read them," because the identity behind the appliance carried permissions its job never required. The blast radius was set years earlier, at the moment the role was granted more than its task.

Blast radius

The exposed records spanned credit-card applications from 2005 through early 2019: names, addresses, dates of birth, self-reported income, and similar fields. It also included, for smaller subsets, around 140,000 Social Security numbers, roughly 80,000 linked bank-account numbers, and about 1 million Canadian Social Insurance Numbers. Capital One later paid an $80 million regulatory penalty and settled a class action for $190 million. The attacker was identified, prosecuted, and convicted.

The same-class lesson

One flaw at the edge should not be able to read the whole vault. Blast radius is designed long before any attack, in the scope you grant an identity — so grant the least privilege the job actually needs, and no more. A firewall's credential should be able to filter traffic, not enumerate and download customer data. When an appliance's identity carries permissions unrelated to its function, every bug in that appliance inherits those permissions. This is drill 47's god-mode account at production scale: the entry point is one component, but the damage is whatever that component's identity was allowed to touch. Scope the role down, segment the data behind separate identities, and the same SSRF becomes a contained incident instead of a hundred-million-record disclosure.

Rhymes with

• Drill 47 — The God-Mode Service Account: an over-permissioned identity turns one compromise into "potentially all of it," because scope, not the entry point, sets the blast radius.
• Drill 42 — The Notebook on GitHub: the same discipline one layer up — credentials must be tightly scoped and short-lived so a single leak stays small.

Named concepts: least privilege, over-permissioned IAM role, SSRF to credential theft, credential scoping, blast radius by design.