This is reactionary. Security is about detecting and preventing disasters like this in the first place rather than always being last to react to breaches as they happen.

If I were Capital One, I would invest in HackerOne and host bug bounties for security researchers.