Capital One fined $80M by regulators over 2019 data breach
(WBJ) Capital One Financial Corp (NYSE: COF) will pay an $80 million fine and enter into a consent order with its regulator, the Office of the Comptroller of the Currency, over issues related to a data breach in 2019 that exposed more than 106 million records of customers and credit card applicants.
McLean-based Capital One said at the time that the breach happened due to “a specific configuration vulnerability” that had since been fixed. The OCC found that the bank failed to establish effective risk assessment processes prior to migrating to a cloud environment. Capital One neither admitted nor denied the findings, according to the consent order.
“The Bank’s internal audit failed to identify numerous control weaknesses and gaps in the cloud operating environment. Internal audit also did not effectively report on and highlight identified weaknesses and gaps to the Audit Committee,” the OCC said in its order. “For certain concerns raised by internal audit, the Board failed to take effective actions to hold management accountable, particularly in addressing concerns regarding certain internal control gaps and weaknesses."
The OCC order, which was also accompanied by a cease-and-desist order, said the bank “has begun addressing the identified corrective action and has been committed to providing resources to remedy the deficiencies.” (Read More)
https://www.bizjournals.com/washington/news/2020/08/06/capital-one-federal-reserve-occ.html
