Capital One attacker may have breached other major corporations
Does anyone know how she gained the IAM role? Many comments mention her exploiting a misconfigured WAF to gain the role needed to access the S3 bucket, but that is not enough detail to understand the attack.