Capital One Hacker Paige Thompson Sentenced to Probation

A man smokes a cigarette outside a building with a capital one logo and capital one cafe logo on the side.

Capital One has been investigated by an arm of the U.S. Department of the Treasury for its allegedly lax security measures prior to the massive 2019 hack.
Photo: MARK RALSTON/AFP (Getty Images)

Paige Thompson, an ex-Amazon software engineer who stole the credit card applications, social security numbers, and bank account numbers of more than 100 million people from Capital One, costing the company at least $270 million, was sentenced to time served and just five years probation late Tuesday in a Washington court.

The 37-year-old Thompson, who also went by the online handle “Erratic,” was found guilty in June of wire fraud, unauthorized access to a computer and damaging a protected computer. The Seattle jury acquitted her of other charges including identity theft, according to the AP. Judge Robert Lasnick said prison would be especially difficult for Thompson “because of her mental health and transgender status.

During the trial, Thompson’s attorneys argued that she never misused the personal information from the companies she hacked. The hacker’s lawyers further argued that Thompson was a white hat hacker who had been attempting to collect money from companies by pointing out vulnerabilities in their systems, according to The Seattle Times. A judge still has to decide restitution for victims of her hacks, which should be determined this December, according to the U.S. Attorney’s office. Capital One reached a settlement of $190 million with affected customers and was fined $80 million by the Treasury Department.

Prosecutors decried what they called a light sentencing, originally asking for Thompson to serve seven years. In a release, U.S. Attorney Nick Brown said prosecutors were “very disappointed with the court’s sentencing decision. This is not what justice looks like.” Prosecutors argued in court that Thompson did hundreds of millions of dollars in damage to both companies and individuals through hacks of not just Capital One, but 30 other companies, educational institutions, and more. Some of those other hacks involved personal data, but prosecutors stopped short of accusing Thompson of selling or sharing any of it.

Prosecutors also argued Thompson used a…