Capital One data breach (2019): what happened and what to do
2 min read · Updated November 8, 2026
In July 2019 Capital One disclosed that an attacker had accessed data on about 100 million people in the United States and around 6 million in Canada, mostly credit card applications. Names, addresses and contact details were involved, and a smaller number of Social Security numbers. Monitor your credit and be wary of related scams.
What happened
Capital One said a person exploited a misconfigured firewall on a cloud-hosted server and copied data from it. The company found out after a tip, informed the authorities and the suspect, a former cloud-provider engineer, was arrested within days.
The incident was disclosed on 29 July 2019. Regulators later fined the bank and the company settled a class action, which shows how seriously a cloud misconfiguration of this size was treated.
What was exposed
- ✓Names, addresses, phone numbers, email addresses and dates of birth from card applications.
- ✓Self-reported income and credit-related information such as scores and limits for some customers.
- ✓About 140,000 US Social Security numbers and roughly 80,000 linked bank account numbers, according to the company.
- ✓Around one million Canadian Social Insurance numbers.
Were you caught up in a major breach?
Old breaches keep circulating for years. Scan your email against known breach records for a one-time $1.99.
Why it still matters
Unlike a leaked password, a Social Security number or date of birth cannot be changed, so the risk to identity lasts for years. Criminals combine such details to open accounts or pass identity checks.
Even people who were not in the most sensitive group were exposed to phishing that quotes real personal details, which makes the messages look genuine.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
- ✓Consider a credit freeze or fraud alert, and review your credit reports for accounts you do not recognise.
Frequently asked questions
Were passwords or full card numbers taken?+
The company said login credentials and full card numbers were not compromised. The exposed data was mainly application information.
Does a breach checker show this breach?+
Not necessarily. This data was not widely published as a searchable list, so assume exposure if you applied for a Capital One card in the affected period.
What is the safest next step?+
Watch your credit reports and statements, and consider a credit freeze if your Social Security number may have been exposed.
Stop guessing. Check your email in seconds.
The Leakill scan looks for your email address in known breach records and delivers a detailed report: the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-time $1.99 payment, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.