Paige A. Thompson a/k/a ‘erratic,’ ended up arrested in July 2019, after Capital One alerted the FBI to her hacking activity. The jury deliberated for ten hours following the seven-day jury trial. Thompson is scheduled for sentencing September 15.
“Ms. Thompson used her hacking skills to steal the personal information of more than 100 million people, and hijacked computer servers to mine cryptocurrency,” said U.S. Attorney Nick Brown. “Far from being an ethical hacker trying to help companies with their computer security, she exploited mistakes to steal valuable data and sought to enrich herself.”
Using Thompson’s own words in texts and online chats, prosecutors showed how Thompson used a tool she built to scan Amazon Web Services accounts to look for misconfigured accounts. She then used those misconfigured accounts to hack in and download the data of more than 30 entities, including Capital One bank. With some of her illegal access, she planted cryptocurrency mining software on new servers with the income from the mining going to her online wallet. Thompson spent hundreds of hours advancing her scheme, and bragged about her illegal conduct to others via text or online forums.
“She wanted data, she wanted money, and she wanted to brag,” said Assistant United States Attorney Andrew Friedman in his closing arguments.
The intrusion to Capital One accounts impacted more than 100 million U.S. Customers. The company was fined $80 million and settled customer lawsuits for $190 million.
Wire fraud is punishable by up to 20 years in prison. Illegally accessing a protected computer and damaging a protected computer are punishable by up to five years in prison.