Paige Thompson

Thompson had worked at AWS in 2015–2016. In March 2019 she found a misconfigured WAF in front of Capital One's servers and got it to make requests on her behalf, a textbook SSRF. The request went to the EC2 instance metadata service, which cheerfully handed over temporary credentials for an IAM role with far too much access. The haul covered roughly 106 million customers in the US and Canada.

She bragged about it on GitHub and in chat channels, an outsider tipped off the bank, and she was arrested in July 2019. In 2022 she was convicted of wire fraud and unauthorised access and sentenced to time served plus probation. Capital One was fined $80 million, and that autumn AWS shipped IMDSv2, which requires a session token that a simple forwarded GET can't obtain.