English | Español
Updated 04:00 PM ET, Friday, April 22, 2022
1. What happened?
On July 19, 2019, we determined that an outside individual gained unauthorized access and obtained certain types of personal information about Capital One credit card customers and individuals who had applied for our credit card products.
We immediately fixed the issue and promptly began working with federal law enforcement. The outside individual who took the data was captured by the FBI. The government has stated they believe the data has been recovered and that there is no evidence the data was used for fraud or shared by this individual.
2. How did you discover the incident?
Like many companies, we have a Responsible Disclosure Program which provides an avenue for ethical security researchers to report vulnerabilities directly to us. The configuration vulnerability was reported to us by an external security researcher through our Responsible Disclosure Program on July 17, 2019. We then began our own internal investigation, leading to the July 19, 2019, discovery of the incident.
3. When did this occur?
On July 19, 2019, we determined that an outside individual gained unauthorized access and obtained certain types of personal information about Capital One credit card customers and individuals who had applied for our credit card products. This occurred on March 22 and 23, 2019.
4. How do I know if I’ve been impacted?
The outside individual who took the data was captured by the FBI. The government has stated they believe the data has been recovered and that there is no evidence the data was used for fraud or shared by this individual.
We have directly notified by mail the U.S. individuals whose Social Security numbers or linked bank account numbers were accessed. We also have notified all Canadian customers affected. Canadian customers can find more information at https://support.capitalone.ca/cyber/facts2019 or www.capitalone.ca/facts2019/fr.
5. Who is responsible for this cyber incident?
The outside individual who took the data was captured by the FBI. The government has stated they believe the data has been recovered and that there is no evidence the data was used for fraud or shared by this individual.
6. Does this incident impact customers from your other businesses?
This incident primarily impacted people who have applied for one of our credit card products as well as credit card customers. Our Auto Finance, Commercial Bank, and customers from our UK card businesses were not impacted.
7. What is Capital One doing to protect me after this incident?
We have sophisticated fraud systems in place to detect any unusual activity and protect our customers from unauthorized actions.
We have notified by mail the U.S. individuals whose Social Security numbers or linked bank account numbers were accessed. We also have notified all Canadian customers affected. Canadian customers can find more information at www.capitalone.ca/facts2019 or www.capitalone.ca/facts2019/fr.
Customers are encouraged to enroll in credit card account alerts to help them keep track of activity on their accounts. Customers can sign in to online banking and set up text or email alerts, based on their preferences.
Additionally, we encourage customers to monitor their credit card accounts for unusual or suspicious activity and, if they notice any activity that they do not recognize, to call the number on the back of their Capital One card or on their statement as soon as possible.
8. I received a call or text from Capital One related to this cyber incident asking for my information. What should I do?
Capital One is not proactively calling, texting or emailing customers to ask for account information or Social Security numbers related to this cyber incident.
If you have provided personal information over the phone or clicked on the links in a fraudulent email, follow these additional steps:
9. Are there any additional steps that I can take to protect myself against fraud and identity theft?
You can request a free copy of your credit report once every 12 months from each of the three national credit reporting agencies: Equifax, Experian and TransUnion.
To obtain free credit reports, simply visit www.annualcreditreport.com, call 1-877-322-8228, or complete the Annual Credit Report Request Form, which can be found here, and mail it to: Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281.
Additionally, you can call the toll-free fraud number of any one of the three nationwide credit bureaus and place an initial or extended fraud alert on your credit report.
An initial fraud alert stays on your credit report for one year and acts as an alert to potential lenders. An extended fraud alert is intended for victims of identity theft and stays on your credit report for seven years.
10. I did not receive a notification that my Social Security number or account number were affected, but I remain concerned. What should I do?
We have notified by mail all individuals whose Social Security numbers or linked bank account numbers were accessed. The outside individual who took the data was captured by the FBI. The government has stated they believe the data has been recovered and that there is no evidence the data was used for fraud or shared by this individual.
11. Is there a settlement related to this cyber incident?
On February 7, 2022, a U.S. federal court preliminarily approved a class action settlement relating to the cyber incident Capital One announced in July 2019. Please visit www.CapitalOneSettlement.com for additional details.