{"id":"https://openalex.org/W4284895455","doi":"https://doi.org/10.1145/3546068","title":"A Systematic Analysis of the Capital One Data Breach: Critical Lessons Learned","display_name":"A Systematic Analysis of the Capital One Data Breach: Critical Lessons Learned","publication_year":2022,"publication_date":"2022-07-07","ids":{"openalex":"https://openalex.org/W4284895455","doi":"https://doi.org/10.1145/3546068"},"language":"en","primary_location":{"id":"doi:10.1145/3546068","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3546068","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3546068","source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3546068","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5034768567","display_name":"Shaharyar Khan","orcid":"https://orcid.org/0000-0002-5426-0778"},"institutions":[{"id":"https://openalex.org/I63966007","display_name":"Massachusetts Institute of Technology","ror":"https://ror.org/042nb2s44","country_code":"US","type":"education","lineage":["https://openalex.org/I63966007"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Shaharyar Khan","raw_affiliation_strings":["Sloan School of Management, Massachusetts Institute of Technology, Cambridge"],"raw_orcid":"https://orcid.org/0000-0002-5426-0778","affiliations":[{"raw_affiliation_string":"Sloan School of Management, Massachusetts Institute of Technology, Cambridge","institution_ids":["https://openalex.org/I63966007"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064641847","display_name":"Ilya Kabanov","orcid":null},"institutions":[{"id":"https://openalex.org/I63966007","display_name":"Massachusetts Institute of Technology","ror":"https://ror.org/042nb2s44","country_code":"US","type":"education","lineage":["https://openalex.org/I63966007"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ilya Kabanov","raw_affiliation_strings":["Sloan School of Management, Massachusetts Institute of Technology, Cambridge"],"raw_orcid":"https://orcid.org/0000-0002-4402-558X","affiliations":[{"raw_affiliation_string":"Sloan School of Management, Massachusetts Institute of Technology, Cambridge","institution_ids":["https://openalex.org/I63966007"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049820283","display_name":"Yunke Hua","orcid":"https://orcid.org/0000-0002-9531-8665"},"institutions":[{"id":"https://openalex.org/I63966007","display_name":"Massachusetts Institute of Technology","ror":"https://ror.org/042nb2s44","country_code":"US","type":"education","lineage":["https://openalex.org/I63966007"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yunke Hua","raw_affiliation_strings":["Sloan School of Management, Massachusetts Institute of Technology, Cambridge"],"raw_orcid":"https://orcid.org/0000-0002-9531-8665","affiliations":[{"raw_affiliation_string":"Sloan School of Management, Massachusetts Institute of Technology, Cambridge","institution_ids":["https://openalex.org/I63966007"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5017345211","display_name":"Stuart Madnick","orcid":"https://orcid.org/0000-0001-9240-2573"},"institutions":[{"id":"https://openalex.org/I63966007","display_name":"Massachusetts Institute of Technology","ror":"https://ror.org/042nb2s44","country_code":"US","type":"education","lineage":["https://openalex.org/I63966007"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Stuart Madnick","raw_affiliation_strings":["Sloan School of Management, Massachusetts Institute of Technology, Cambridge"],"raw_orcid":"https://orcid.org/0000-0001-9240-2573","affiliations":[{"raw_affiliation_string":"Sloan School of Management, Massachusetts Institute of Technology, Cambridge","institution_ids":["https://openalex.org/I63966007"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I63966007"],"apc_list":null,"apc_paid":null,"fwci":15.6416,"has_fulltext":true,"cited_by_count":62,"citation_normalized_percentile":{"value":0.99067279,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":100},"biblio":{"volume":"26","issue":"1","first_page":"1","last_page":"29"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13181","display_name":"Economic and Technological Systems Analysis","score":0.9643999934196472,"subfield":{"id":"https://openalex.org/subfields/1405","display_name":"Management of Technology and Innovation"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11864","display_name":"Supply Chain Resilience and Risk Management","score":0.9587000012397766,"subfield":{"id":"https://openalex.org/subfields/1408","display_name":"Strategy and Management"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/mistake","display_name":"Mistake","score":0.7950308322906494},{"id":"https://openalex.org/keywords/data-breach","display_name":"Data breach","score":0.6681917309761047},{"id":"https://openalex.org/keywords/phishing","display_name":"Phishing","score":0.6592376232147217},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6448910236358643},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.5730711221694946},{"id":"https://openalex.org/keywords/government","display_name":"Government (linguistics)","score":0.5302531123161316},{"id":"https://openalex.org/keywords/personally-identifiable-information","display_name":"Personally identifiable information","score":0.4863489270210266},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.462100625038147},{"id":"https://openalex.org/keywords/work","display_name":"Work (physics)","score":0.4532696604728699},{"id":"https://openalex.org/keywords/capital","display_name":"Capital (architecture)","score":0.4405936002731323},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.4390602111816406},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.41227272152900696},{"id":"https://openalex.org/keywords/public-relations","display_name":"Public relations","score":0.3246898651123047},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.1930868923664093},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.1483093798160553},{"id":"https://openalex.org/keywords/law","display_name":"Law","score":0.14164385199546814},{"id":"https://openalex.org/keywords/political-science","display_name":"Political science","score":0.1400924026966095},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.12834253907203674}],"concepts":[{"id":"https://openalex.org/C2777179996","wikidata":"https://www.wikidata.org/wiki/Q911222","display_name":"Mistake","level":2,"score":0.7950308322906494},{"id":"https://openalex.org/C165609540","wikidata":"https://www.wikidata.org/wiki/Q1172486","display_name":"Data breach","level":2,"score":0.6681917309761047},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.6592376232147217},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6448910236358643},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.5730711221694946},{"id":"https://openalex.org/C2778137410","wikidata":"https://www.wikidata.org/wiki/Q2732820","display_name":"Government (linguistics)","level":2,"score":0.5302531123161316},{"id":"https://openalex.org/C169093310","wikidata":"https://www.wikidata.org/wiki/Q3702971","display_name":"Personally identifiable information","level":2,"score":0.4863489270210266},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.462100625038147},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.4532696604728699},{"id":"https://openalex.org/C83646750","wikidata":"https://www.wikidata.org/wiki/Q193893","display_name":"Capital (architecture)","level":2,"score":0.4405936002731323},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.4390602111816406},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.41227272152900696},{"id":"https://openalex.org/C39549134","wikidata":"https://www.wikidata.org/wiki/Q133080","display_name":"Public relations","level":1,"score":0.3246898651123047},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.1930868923664093},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.1483093798160553},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.14164385199546814},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.1400924026966095},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.12834253907203674},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C78519656","wikidata":"https://www.wikidata.org/wiki/Q101333","display_name":"Mechanical engineering","level":1,"score":0.0},{"id":"https://openalex.org/C166957645","wikidata":"https://www.wikidata.org/wiki/Q23498","display_name":"Archaeology","level":1,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.0},{"id":"https://openalex.org/C95457728","wikidata":"https://www.wikidata.org/wiki/Q309","display_name":"History","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3546068","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3546068","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3546068","source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},{"id":"pmh:oai:dspace.mit.edu:1721.1/146397","is_oa":false,"landing_page_url":"https://hdl.handle.net/1721.1/146397","pdf_url":null,"source":{"id":"https://openalex.org/S4306400425","display_name":"DSpace@MIT (Massachusetts Institute of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I63966007","host_organization_name":"Massachusetts Institute of Technology","host_organization_lineage":["https://openalex.org/I63966007"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"ACM","raw_type":"Article"}],"best_oa_location":{"id":"doi:10.1145/3546068","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3546068","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3546068","source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.7099999785423279}],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4284895455.pdf","grobid_xml":"https://content.openalex.org/works/W4284895455.grobid-xml"},"referenced_works_count":6,"referenced_works":["https://openalex.org/W1504573138","https://openalex.org/W2134732423","https://openalex.org/W2515148583","https://openalex.org/W3016512116","https://openalex.org/W3176677437","https://openalex.org/W4245587674"],"related_works":["https://openalex.org/W1590719878","https://openalex.org/W4244271513","https://openalex.org/W2067228051","https://openalex.org/W3125933069","https://openalex.org/W4317641462","https://openalex.org/W2150351189","https://openalex.org/W2981397177","https://openalex.org/W2508301561","https://openalex.org/W2158114612","https://openalex.org/W4296578483"],"abstract_inverted_index":{"The":[0],"2019":[1],"Capital":[2,138],"One":[3,139],"data":[4,11],"breach":[5],"was":[6],"one":[7,69],"of":[8,18,21,127,165],"the":[9,14,82,87,98,101,125,137,162],"largest":[10],"breaches":[12],"impacting":[13],"privacy":[15],"and":[16,90,129,149,151,172,195],"security":[17,166],"personal":[19],"information":[20,170],"over":[22],"a":[23,31,41,46,49,72],"100":[24],"million":[25],"individuals.":[26],"In":[27,132],"most":[28],"reports":[29],"about":[30],"cyberattack,":[32],"you":[33,93],"will":[34],"often":[35],"hear":[36],"that":[37,78,177,189],"it":[38,59],"succeeded":[39],"because":[40],"single":[42],"employee":[43],"clicked":[44],"on":[45],"link":[47],"in":[48,96,168],"phishing":[50],"email":[51],"or":[52,74],"forgot":[53],"to":[54,122,160,180,193],"patch":[55],"some":[56],"software,":[57],"making":[58],"seem":[60],"like":[61],"an":[62,187],"isolated,":[63],"one-off,":[64],"trivial":[65],"problem":[66],"involving":[67],"maybe":[68],"person,":[70],"committing":[71],"mistake":[73],"being":[75],"negligent.":[76],"But":[77],"is":[79],"usually":[80],"not":[81],"complete":[83],"story.":[84],"By":[85],"ignoring":[86],"related":[88],"managerial":[89],"organizational":[91],"failures,":[92],"are":[94],"leaving":[95],"place":[97],"conditions":[99],"for":[100,154],"next":[102],"breach.":[103],"Using":[104],"our":[105],"Cybersafety":[106],"analysis":[107],"methodology,":[108],"we":[109,135],"identified":[110],"control":[111,114,143],"failures":[112,167],"spanning":[113],"levels,":[115],"going":[116],"from":[117],"rather":[118],"technical":[119],"issues":[120],"up":[121],"top":[123],"management,":[124],"Board":[126],"Directors,":[128],"Government":[130],"regulators.":[131],"this":[133],"analysis,":[134],"reconstruct":[136],"hierarchical":[140],"cyber":[141],"safety":[142],"structure,":[144],"identify":[145],"what":[146],"parts":[147],"failed":[148],"why,":[150],"provide":[152],"recommendations":[153],"improvements.":[155],"This":[156],"work":[157],"demonstrates":[158],"how":[159],"discover":[161],"true":[163],"causes":[164],"complex":[169],"systems":[171],"derive":[173],"systematic":[174],"cybersecurity":[175],"improvements":[176],"likely":[178],"apply":[179],"many":[181],"other":[182],"organizations.":[183,199],"It":[184],"also":[185],"provides":[186],"approach":[188],"individuals":[190],"can":[191],"use":[192],"evaluate":[194],"better":[196],"secure":[197],"their":[198]},"counts_by_year":[{"year":2026,"cited_by_count":12},{"year":2025,"cited_by_count":31},{"year":2024,"cited_by_count":12},{"year":2023,"cited_by_count":7}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}