WASHINGTON -- The U.S. Treasury Department has fined Capital One $80 million for careless network security practices that enabled a hack that accessed the personal information of 106 million of the bank’s credit cardholders.
The Comptroller of the Currency said in a consent order Thursday that Capital One failed in 2015 to establish effective risk management when it migrated information technology operations to a cloud-based service.
It said the bank’s own internal audit failed to identify “numerous weaknesses” in its management the cloud environment and “engaged in unsafe or unsound practices that were part of a pattern of misconduct.”
The consent order said Capital One has committed to fixing the problem. Email to Capital One requesting comment wasn't immediately returned.
Among the largest of its kind on record, the 2019 breach compromised about 140,000 Social Security numbers and 80,000 bank account numbers. The accused hacker, former Amazon software engineer Paige
Thompson, has pleaded innocent to charges related to the breach.
Thompson, a transgender woman, is set to stand trial in February. Her lawyers have sought to have her released to a halfway house where she would have better access to mental health care, but the judge in the case denied the request saying she was a flight risk and danger to others.
No evidence has emerged that Thompson sought to benefit financially from the hack.
-- ABC News Aug 7
treasury /ˈtreʒəri/ 宝库、国库
The U.S. Treasury Department 美国财政部
fine n. vt. 罚款
enable 是能够、导致
The Comptroller of the Currency 美国货币监理署
Office of the Comptroller of the Currency (OCC)
a con`sent order 同意令
A Consent Order is a legally binding fi`nancial agreement 同意令指具有法律效应的金融协议
migrate v.移动、转移
audit 审计、稽核、审查
`nu·merous /ˈnuːmərəs/ 许多的、很多的
misconduct /ˌmɪsˈkɑːndʌkt/ 不当行为、行为不检
has committed to do sth 已承诺做某事
kind on record 历史上、有史以来
breach v.违背、违法；网络常用“黑客入侵”意思
e.g. British Airways breach: How did hackers get in?
accused 被告、控告
the accuesed（hacker、police） 被控告、指控的（黑客、警察）
plead v.接口，为…辩护、辩称
`innocent 天真的人；无罪的、无辜的
charge 充电、控告
trans`gender 跨性别者、变性人
trial /ˈtraɪəl/ 实验、审讯、审讯的
set to stand trial （令其站立） 准备受审
sought seek的过去式 v.寻找、寻求
halfway house
halfway house，在一些州也被称为“sober living house”，是为那些从毒品或酒精中恢复的人提供的过渡性生活设施。有些人在离开长期戒毒所、监狱或无家可归的地方后去的地方，而另一些人为了开始他们的康复之旅而去的一个清醒的生活环境。在某些情况下，人们也会因为法院的命令而被关进halfway house。
evidence /ˈevɪdəns/ 证据、证明
e`merge vi.出现、浮现、表现
华盛顿 -- 美国财政部对第一资本处以8000万美元的罚款，原因是该公司在网络安全方面粗心大意，导致黑客侵入了该银行1.06亿信用卡持有人的个人信息。
美国货币监理署周四在一份同意令中说，第一资本在2015年将信息技术业务转移到一项基于云的服务中，未能建立有效的风险管理。
报告称，该行自身的内部审计未能发现其云环境管理中的“众多弱点”，并“从事了不安全或不健全的行为，属于不当行为模式的一部分”。
同意令称，第一资本已承诺解决这一问题。记者发电子邮件给Capital One要求置评，但未得到立即回复。
2019年的黑客入侵是有史以来规模最大的一次，约14万个社会安全号码和8万个银行账号被盗。被指控的黑客是前亚马逊软件工程师佩奇。
汤普森对与此次泄密有关的指控辩称自己是无辜的。
汤普森是一名跨性别女性，将于明年2月接受审判。她的律师试图将她释放到一个中途之家，在那里她可以获得更好的心理治疗，但本案的法官拒绝了这一请求，称她有逃跑的风险，对其他人有危险。
没有证据表明汤普森试图从黑客攻击中获得经济利益。
