【2023.9 Update】Some people have already received their settlement payments—reports include $282 and $707, which is a pretty meaningful amount. If you filed a claim too, keep an eye out for emails from [email protected].

【2022.7 Update】The settlement process has finally started. The total class action settlement amount is $190,000,000. Capital One will provide ID protection services to 98,000,000 affected people, and if you suffered losses because your information was stolen, there may also be cash compensation.

The annoying part is that you need to receive your Capital One ID and PIN before you can submit a claim.

【2021.12 Update】According to The Seattle Times, Capital One agreed to provide $190,000,000 in compensation for the data breach.

Capital One Data Breach

What Happened

On Monday (2019/7/29), Capital One announced that 100 million credit card applications were exposed, and nearly a thousand SSNs and bank account numbers were stolen. The hacker has already been arrested and was reportedly an employee of a cloud storage company previously used by Capital One. According to Capital One, the breach involved the following:

  • no credit card numbers or log-in credentials were compromised: no credit card numbers or online banking login credentials were exposed
  • Over 99% of social security numbers were not compromised: more than 99% of SSNs were not exposed.
  • 140,000 social security numbers were stolen & 80,000 linked bank account numbers: 140,000 SSNs were stolen, along with 80,000 linked bank account numbers
  • The social security numbers that were stolen were from customers that used their Social Security number as their Employer Identification number in applying for small business credit cards：the stolen SSNs belonged to customers who used their SSN as their EIN when applying for small business credit cards
  • Stolen data includes names, addresses, zip codes/postal codes, phone numbers, email addresses, dates of birth, and self-reported income：the stolen data included names, addresses, ZIP codes, phone numbers, email addresses, dates of birth, and income
  • Credit credit data was also stolen：this also included customer information such as credit scores, credit limits, balances, payment information, contact information, and transaction data

Related news coverage:

What You Should Do

So far, Capital One has not provided much guidance beyond reporting that the suspect has been arrested and is awaiting trial. Based on the exposed SSNs, many of the affected people appear to be those who used an SSN instead of an EIN when applying for small business credit cards. That overlaps with some business card applicants in our community. If you have applied this way, pay close attention to your credit reports and credit score. If you do not plan to apply for a new credit card or personal loan in the near term, you may want to consider freezing your credit reports first.

Possible Consequences of a Data Breach

  • Credit cards on your credit report that you did not apply for: As you can see, with your name, SSN, address, and date of birth, someone can potentially apply for credit cards quite easily. If an online application is auto-approved and the criminal then calls in to reroute the card, you can effectively become an unwilling ATM. They run up charges and do not pay them back, while you are left dealing with the fallout.
  • Identity theft: With this information, someone can pretend to be you. They could apply for local or online small loans in your name, and you would be the one stuck with the consequences. Even medical bills could potentially end up tied to you. After all, it is hard for others to verify whether someone holding all of your personal information is really you. They could even use your identity to scam your family members.
  • Your personal information gets mined and resold: With the data above, more information about you can be pulled from third-party sources, such as your school, family members, and job. That information can then be sold directly to marketers at various companies. After a personal data leak, you may start receiving all kinds of marketing calls.
  • Scams using your information: Have you ever received calls claiming to be from the Chinese consulate, the police, or the IRS? Those are often easier to spot because ordinary scammers usually have only limited, non-core information about you. But if someone calls and starts “verifying” your SSN, date of birth, address, and driver’s license number, you may be much more likely to trust them.

What to Do After a Data Breach

  • Freeze your credit reports (Freeze report): For a new credit card or personal loan application, one required step is checking your credit report. If your reports are frozen, others generally cannot apply using your identity. That said, if a criminal goes further, they may even try to unfreeze your reports using your information. In general, though, criminals usually have plenty of data to work with and will not spend extra effort targeting just one person. So in most cases, freezing your reports can prevent further credit damage.
  • Monitor your credit reports: If you did not freeze your reports in time, be sure to carefully review all three of your credit reports. Check whether there are extra hard pulls, new credit cards, new addresses, new names, or new employment information. If you see anything unusual, freeze your credit reports immediately and contact the credit bureaus to remove the fraudulent information. It is best to review them once a month.
  • Watch for changes in your credit score: If your credit score suddenly drops, there is a good chance something serious has happened on your credit report, such as unpaid debt. Your score can be a quick way to detect problems.
  • Make sure you and your family stay alert for scammers: As mentioned above, once someone has your information, it becomes much easier for them to scam you. Be especially careful, and tell your family members as well that if anything seems off, they should confirm with you directly in person.
  • Protect your personal information: Personal information is extremely important in the U.S. Do not treat your name, ID information, and address casually—make sure to safeguard them carefully.
  • Learn more about this topic