the hacking happening means the accounts weren't secure, hence the fines and settlement. the insecure configuration is not tied to the hack, and was only expos

the hacking happening means the accounts weren't secure, hence the fines and settlement. the insecure configuration is not tied to the hack, and was only exposed because of it. the insecure configuration was there, independent of the hacking, yes, but it was unknown. so, the hacker only made regulators aware of the problem, and that's what Capital One blames the hacker for. regulators would not have known if the hacker didn't take advantage of their insecure configuration, and now, regulators are fining them. to you and me, the fault is on capital one for having the insecure configuration, and on the hacker for exploiting it. to capital one, they did nothing wrong, and were only punished because of the actions of someone else.