The US Appeals Court Decides The Capital One Hacker’s Sentence Was Too Lenient
Please note that we are not authorised to provide any investment advice. The content on this page is for information purposes only.
The US appeals court recently decided to overrule the sentence given to the Capital One hacker, who was responsible for a massive data breach back in 2019. According to the court, the original sentence was too light.
Paige Thompson, the hacker responsible for the incident, was sentenced back in 2022 to five years’ probation, plus time served for wire fraud, which was in violation of the Computer Fraud and Abuse Act.
Formerly an employee at Amazon, Thompson accessed information of around 100 million American, as well as six million Canadian customers, that was stored on the Amazon Web Service’s (AWS) servers.
The Sentence Was Too Light According To The US Appeals Court
The investigation and the following indictment said that Thompson created a scanning software that granted her access to AWS customers’ information, even allowing her to identify those who had misconfigured their firewalls. Thanks to this, she found that it was possible for outside commands to breach the defenses and access their servers.
Thompson then used this vulnerability to steal data. However, the panel of appeal court judges believes that the sentence was too lenient, overruling her sentence two-to-one. The judges decided that the incident deserved a harsher punishment, given that it was the second-largest data breach in US history at the time.
Not only that, but it caused tens of millions of dollars in damages, not to mention emotional and reputational harm caused to individuals and entities alike.
The incident was also extremely costly for Capital One. Not only did it receive an $80 million fine from the regulators, but it also had to pay out another $190 million in customer lawsuits. Despite this, the district court concluded that Thompson’s actions were not malicious and that she did not do anything bad before being caught, also concluding that she was “tortured and tormented about what she did.”
The appeals court now views this as an error on the district court’s side, especially since these court findings were not supported by the record. The district court was right to take the fact that Thompson is transgender and autistic at the time when it decided on the sentence, but the appeals court now says that this may not be the sole basis for sentencing. As a result, the case was sent back to the district court, which is expected to review it and decide on a new sentence.
