Calling the 2019 Capital One breach “an SSRF attack” is a shorthand that the public record does not support on its own. The U.S. Department of Justice describes the intrusion as enabled by a misconfigured web application firewall (WAF), followed by commands, stolen credentials, and copying of customer data. Server-side request forgery (SSRF) appears in the record only as a characterization that AWS was quoted as holding in a later civil complaint. The accurate description is a chain of configuration and access-control failures, with SSRF as one possible technique inside that chain.
What the criminal case says happened
The DOJ’s case summary states that the intrusion occurred through a misconfigured web application firewall that enabled access to data. The superseding indictment fills in the sequence as the government alleges it: scanners identified public-facing servers whose WAF misconfiguration let outside commands reach and execute on those servers. Those commands obtained credentials for customer accounts or roles, and the credentials were then used to access and copy data.
As an Amazon Associate I earn from qualifying purchases.
These are allegations in a criminal filing. They describe the intrusion in operational terms, and they do not use the term SSRF. Readers should treat the indictment’s sequence as the government’s account rather than as a set of technical findings that a court has independently tested step by step.
Where the SSRF label comes from
SSRF is a class of vulnerability in which an attacker induces a server to make requests the attacker could not make directly, such as reaching internal services or metadata endpoints. The label entered public discussion through a federal civil complaint, which quotes AWS as believing an SSRF attack was used after the attacker gained access through the misconfigured firewall.
#1 Best Overall
That is useful evidence that the SSRF characterization was part of the litigation record. It is an attributed assessment inside a pleading, not a judicial finding about how the attacker’s requests were built. No document reviewed here offers a single uncontested technical account that settles whether SSRF fully describes the request path in this incident. The defensible claim is narrower than either “it was SSRF” or “it was not SSRF”: the public record ties SSRF to the incident through AWS’s belief in litigation, and the criminal case describes a broader chain.
The four stages readers should separate
Most confusion comes from collapsing the incident into one exploit label. The record supports separating it into four stages:
- Initial access weakness. A misconfigured WAF on public-facing servers, as described in the DOJ case summary.
- Credential retrieval or request technique. Outside commands reached and ran on those servers and obtained credentials. This is the stage to which SSRF is attributed, by AWS in the civil complaint.
- Permissions of the obtained credentials. The credentials gave access to customer accounts or roles, so the scope of what they could reach depended on how those roles were configured.
- Data access and copying. The credentials were used to access and copy data, which is the outcome that produced the disclosed exposure.
Describing the breach as “an SSRF story” compresses these into the second stage and leaves out the configuration and permission failures that made stages three and four possible.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Capital One’s own disclosure adds a point that matters for the cloud question. The company said this type of vulnerability is not specific to the cloud, and that the infrastructure elements involved can exist in cloud and on-premises data centers. In its July 29, 2019 announcement, Capital One stated: “This type of vulnerability is not specific to the cloud.” That supports framing the incident around configuration and access controls rather than around cloud hosting as such. It does not mean the cloud environment played no role in the event.
Rank #3
Timeline
| Date | Event | Source |
|---|---|---|
| March 22–23, 2019 | Unauthorized access occurred, according to Capital One | Capital One |
| July 17, 2019 | An outside security researcher reported the configuration vulnerability through Capital One’s responsible disclosure program. The DOJ case summary also says a GitHub user alerted the company to possible theft that day. | Capital One; DOJ case summary |
| July 19, 2019 | Capital One determined that unauthorized access had occurred and contacted federal law enforcement | Capital One; DOJ case summary |
| July 29, 2019 | Capital One publicly announced the incident | Capital One |
| January 27, 2021 | Further analysis identified approximately 4,700 additional U.S. applicants or cardholders whose Social Security numbers were among the accessed data | Capital One |
| February 22, 2021 | Capital One announced that update | Capital One |
Impact figures and what they cover
The exposure numbers changed as the company’s analysis continued, so each figure needs its publisher and year.
| Figure | Reported by | Scope and qualification |
|---|---|---|
| Approximately 100 million people in the United States | Capital One, 2019 | The company’s reported approximate affected-population figure at the time of its announcement |
| Approximately 6 million people in Canada | Capital One, 2019 | The company’s reported approximate affected-population figure at the time of its announcement |
| Approximately 4,700 U.S. credit card customers or applicants with Social Security numbers among accessed data | Capital One, 2021 | Additional people not included in the earlier disclosure, identified by later analysis |
The categories of data also need precision. Capital One’s 2019 announcement said the accessed material included application information such as names, addresses, phone numbers, email addresses, dates of birth, and self-reported income. It also included portions of customer status data and fragments of transactions from 23 days across 2016, 2017, and 2018. The company said no credit card account numbers or login credentials were compromised, and it reported specific exceptions involving Social Security numbers and linked bank account numbers. Describing the incident as “all records were stolen,” or implying that payment card numbers were exposed, goes beyond what the company reported.
Richard D. Fairbank, Chairman and CEO of Capital One, said in the July 29, 2019 announcement: “I sincerely apologize for the understandable worry this incident must be causing those affected and I am committed to making it right.”
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →How to describe the breach accurately
A precise sentence that holds up against the record is this: the criminal case describes a misconfigured web application firewall that let outside commands reach servers and obtain credentials, which were then used to access and copy customer data; AWS was quoted in later civil litigation as believing SSRF was used after the firewall access.
Best Value
When writing headlines or summaries, avoid two errors. The first is treating SSRF as the whole explanation. The second is claiming that SSRF has been ruled out. Neither the criminal materials nor the civil pleading resolves every technical detail of the request path, and no court has issued a definitive finding on that point in the material reviewed.
Readers asking “Did the breach happen because Capital One used the cloud?” should note that Capital One itself said the vulnerability type is not specific to the cloud. Readers asking “What was misconfigured?” should note that the DOJ case summary identifies the web application firewall.
Sources and limits
- The DOJ case summary and superseding indictment are the strongest sources for the criminal case’s description of the intrusion.
- Capital One’s July 29, 2019 announcement and its January–February 2021 update are the primary sources for the timeline, affected-population figures, and data categories.
- The civil complaint is the source for AWS’s attributed SSRF belief. It is a pleading that contains the attribution, not a ruling on it.
No technical report reviewed here settles the exploit taxonomy beyond these accounts, so any stricter technical claim would overstate the evidence.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
