The 2019 Capital One breach did not show that public cloud is inherently unsafe, or that a customer can outsource accountability to its cloud provider. It showed how a web-facing configuration error, a metadata credential path, broad storage permissions, weak alert resolution, and years of retained application data can combine into one legally consequential control failure.
