Thompson, who used the online moniker “erratic,” has been accused of accessing the personal information of roughly 106 million people — 100 million in the United States and 6 million in Canada — including, in some cases, social security numbers and bank account numbers.
Thompson, 33, of Seattle, reportedly obtained the data from Capital One’s AWS servers after exploiting a firewall misconfiguration and a server-side request forgery (SSRF) vulnerability. Capital One, one of the biggest payment card issuers in the U.S., discovered the breach in mid-July after someone informed the company that the leaked data had apparently been hosted on GitHub.
