A couple of months back, ex-Amazon employee Paige Thompson was accused of gaining unauthorized access to the cloud servers of the US-based bank Capital One and 30 other entities.
Thompson, who is currently in custody, was indicted on Wednesday and charged with Wire Fraud, Computer Fraud and Abuse. She will be presented in front of the court on September 5.
During the breach that happened around March 2019, Thompson stole data from entities including a US state agency and a public research university, who were customers of a “cloud computing company.”
She did so by taking advantage of the misconfigured firewalls on victims’ cloud servers. She created software that searched for any such fragile firewall that could be easily broken down.
That “unnamed” cloud company could most likely be Amazon (AWS). The e-commerce giant’s name was recently dragged into a lawsuit filed by affected Capital One customers against the bank.
Not just the data
A new piece of information has also come to light: Thompson got hold of ‘a lot more’ than the financial details of 106 million people from Capital One.
According to court documents, Thompson used the compromised cloud servers of Capital One and others to mine cryptocurrency — a process known as cryptojacking.
The documents don’t provide much information on what and how much of the cryptocurrency was mined. She herself bragged multiple times about her crypto-jacking hobbies in Slack conversations.
“I’ll be employed again soon and if I had a partner I could have them take over my crypto-jacking enterprise and be a stay at home,” she posted under a false name.
She wrote on June 26 that she “lost a whole fleet of miners all at the same time, so I think someone is onto me.” It was in July this year when her cover was blown as an unnamed source notified Captial One about the massive data breach.
If found guilty, the hacker could face up to 25 years in prison.
Also Read: Avast And French Cops Save 850,000 PCs From Retadup Crypto Malware