Incident Score: Analysis & Impact (AMA1781685326)

In this Rankiteo incident briefing, we review the Amazon Web Services (AWS) breach identified under incident ID AMA1781685326.

The analysis begins with a detailed overview of Amazon Web Services (AWS)'s information like the linkedin page: https://www.linkedin.com/company/amazon-web-services, the number of followers: 10888264, the industry type: IT Services and IT Consulting and the number of employees: 148035 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 817 and after the incident was 813 with a difference of -4 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on Amazon Web Services (AWS) and their customers.

On 29 July 2019, Capital One disclosed Data Breach issues under the banner "Capital One Breach: One of the Largest Financial Data Exposures in U.S. History".

In 2019, Capital One suffered one of the most significant financial data breaches in U.S.

The disruption is felt across the environment, affecting AWS cloud infrastructure, data storage buckets, and exposing 106 million records (names, addresses, phone numbers, emails, dates of birth, self-reported income, Social Security numbers, bank account numbers, credit scores, limits, balances, payment histories), with nearly 106 million records at risk, plus an estimated financial loss of $270 million (fines and settlements).

In response, teams activated the incident response plan, moved swiftly to contain the threat with measures like Patched vulnerability, revoked compromised credentials, and began remediation that includes Overhaul of cloud security protocols, enhanced monitoring, and stakeholders are being briefed through Public disclosure on July 29, 2019.

The case underscores how Closed (conviction in 2022, resentencing in 2025), teams are taking away lessons such as Critical cloud security lapses (misconfigured firewall, inadequate audits, delayed detection). Importance of risk assessment before cloud migration, and recommending next steps like Improve cloud security protocols, enhance internal audits, implement real-time monitoring for unauthorized access, with advisories going out to stakeholders covering Yes (public disclosure, class-action settlement details).

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.