“AWS was not compromised in any way and functioned as designed. The perpetrator gained access through a misconfiguration of the web application and not the underlying cloud-based infrastructure. As Capital One explained clearly in its disclosure, this type of vulnerability is not specific to the cloud.”
AWS: User Configuration Errors Lead to Data Leaks
In addition to the Capital One data breach, additional data leaks involving customers and contractors that misconfigured AWS include:- June 2019: Data management software provider Attunity now owned by Qlik, left massive amounts of backup data exposed on AWS.
- August 2018: An AWS S3 error exposed GoDaddy configuration data from thousands of servers, UpGuard cyber risk management said.
- May 2018: A non-profit organization in Los Angeles County misconfigured an AWS S3 cloud bucket — leaving 3 million records and highly sensitive health information exposed.
- February 2018: FedEx customer identification records were discovered on an unsecured Amazon Simple Storage Service (S3) cloud server, Kromtech Security Center reported.
- October 2017: Accenture Cloud mission critical intellectual property (IP) was exposed via an Amazon Web Services (AWS) cloud leak.
- September 2017: More than 4 million Time Warner Cable customer records were exposed via an AWS cloud leak.
- July 2017: A World Wrestling Entertainment (WWE) database leak exposed the personal information of more than 3 million users.
- July 2017: About 2.2 million Dow Jones subscribers were affected by a data leak that occurred due to a misconfigured AWS cloud account.
- An AWS Security Hub that provides alerts & compliance status updates across AWS user accounts.
- The AWS re:Inforce conference, which specifically focuses on proper cloud cybersecurity.
- Various MSP and MSSP partner programs to train partners on proper AWS security. (Related: ChannelE2E lists the Top 100 Public Cloud MSPs here.)