The law firm Tycko & Zavareei has filed a lawsuit , related to personal data of over 100 million customers of the Capital One banking holding, including information about approximately 140 thousand social security numbers and 80 thousand bank account numbers. Alongside Capital One, the defendants include the company GitHub, which is accused of providing the means for posting, displaying, and using information obtained from the hack.
According to the plaintiff, GitHub is obligated to comply with the existing US laws that prohibit the public posting of users' social security numbers. Specifically, since social security numbers have a fixed format, the company should have implemented filters to identify instances of users posting leak results and block them without waiting for official notifications.
GitHub representatives stated that the plaintiff's claims are inaccurate and that no personal data obtained from the leak was posted on GitHub. In one repository, only instructions on how to retrieve data were placed, which actually remained in a database hosted on Amazon S3. Due to improper firewall configuration limiting access to web applications, it was possible to access the storage on Amazon S3. Upon the first notification from Capital One, the posted instructions were removed from GitHub.
As part of the investigation, a former Amazon employee, who discovered the issue in March and posted information on GitHub to gain access in April, was also arrested. Details describing the problem remained on GitHub from April 21 until mid-July. Capital One is accused in the lawsuit of inadequate monitoring of unauthorized access, which allowed the leak to go unnoticed for about three months.
Forrás: opennet.ru
