Indictment of Capital One suspect alleges breaches of 30 companies, cryptojacking

A federal grand jury indicted Paige Thompson, the accused Capital One hacker, in connection with allegations that she accessed data on more than 30 companies and used that illicit access to generate cryptocurrency, the Department of Justice said Wednesday.

Thompson was arrested on July 29 on suspicion of hacking into the bank’s systems and accessing data on roughly 106 million people. The indictment this week reiterates many of the allegations laid out in last month’s FBI complaint against Thompson, adding accusations that she obtained sensitive data from companies outside Capital One, including an unnamed university and a telecommunications firm.

Federal attorneys from the Western District of Washington also say Thompson, upon breaching victim organizations, leveraged their computing power to mine for cryptocurrency, an activity known as cryptojacking.

Thompson, 33, is a Seattle-based software engineer who formerly worked for Amazon Web Services, the cloud computing giant on which Capital One relies to store sensitive data.

Authorities have accused Thompson, who went by the name “erratic” online, of building a scanning software that enabled her to search for customers of an unnamed cloud company (almost certainly AWS) with misconfigured firewalls. By exploiting that misconfiguration, according to prosecutors, Thompson could issue remote commands to those servers, obtaining data and other access.

AWS previously said it has discovered no “significant issues” at companies allegedly ensnared in the scheme.

Cryptojacking charges

The indictment filed Wednesday contains few details about the alleged cryptojacking. It’s an emerging money-making technique which involves outsiders hijacking an unprotected system, such as a cloud server, and quietly diverting a victim’s computing power to build up a store of digital currency, typically bitcoin or Monero.

Guesses about the popularity of this scam vary wildly, though French authorities shut down a botnet that apparently used 850,000 servers to walk off with millions of dollars in digital coins, according to the BBC.

Thompson is charged with one count of computer fraud and abuse and one count of wire fraud, two charges that could result in up to 25 years in prison if convicted.

You can read the full indictment below.

[documentcloud url=”http://www.documentcloud.org/documents/6359797-Thompson-Indictment.html” responsive=true]