how it happened
- whoformer cloud employeeknew the platform
- the gapmetadata servicehanded out temporary credentials
- thenstorage bucketsundetected ~4 months
- the result100M+ people~$270M total cost
what everyone assumed
Moving to a reputable cloud feels like inheriting its security, a managed environment where the hard parts are handled. The assumption is that the provider’s protections cover you, blurring the line between what they secure and what you must.
what happened
A former employee of the cloud provider exploited a misconfiguration in the bank’s firewall to reach an internal metadata service, obtain temporary credentials, and read the bank’s storage buckets. The platform was secure; the bank’s configuration of it was not, and the difference was 100 million people.
step by step
- a firewall is misconfiguredThe cloud platform is secure; the bank's configuration of it is not.the assumption breaks here
- the attacker reaches an internal metadata serviceIt hands out temporary credentials.
- storage buckets are readThe intrusion goes unnoticed for about four months.
- 2019over 100 million people exposedAbout $270 million in costs, including an $80 million fine.
how it surfaced
In 2019 the breach exposed over 100 million individuals across the US and Canada and cost the bank around $270 million including an $80 million regulatory fine. The intrusion sat undetected for about four months.
A managed cloud secures the platform and leaves your configuration to you, and the configuration is where breaches happen.
Shared responsibility means the provider’s certifications do not cover the settings you control.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersSomeone who knows where to look uses that setting to pull your files.what it costs youThe provider was secure the whole time. The leak was your configuration, and it is your name in the news.
- or it goes like thisit happenedMicrosoft AI data exposure, 2023howA share link meant for one folder opens the whole storage account.what leavesbackups, passwords and private messageswho ends up with itanyone who finds the link
- or it goes like thisit happenedPower Apps misconfiguration, 2021howA default on a no-code app leaves its data readable without logging in.what leavespersonal records you collectedwho ends up with itanyone who looks
sources
your turn
what you can do about it
this week
Pick your main cloud or SaaS platform and list the settings that are yours to get right.
Your cloud and SaaS providers publish impressive security credentials, and your own configuration of them is a separate thing you own entirely. Capital One is the line between the two made expensive. Knowing which settings and access are yours to get right, not the vendor's, is where the real exposure sits.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →