A former Amazon employee was arrested and charged with stealing more than 100 million consumer applications for credit from Capital One. A source with direct knowledge of the breach investigation says the problem stemmed in part from a misconfigured open-source Web Application Firewall (WAF) that Capital One was using as part of its operations hosted in the cloud with Amazon Web Services. The intruder used a Server Side Request Forgery (SSRF) attack, in which a server can be tricked into running commands that it should never have been permitted to run, including those that allow it to talk to the metadata service.”]
Source: https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/