How could they figure out the internal account number without hacking into the bank in the first place? I’m fairly certain there’s no way to derive the account number from a debit card number or any of the info you mentioned.

Via the data leak issue I mentioned? [https://www.bankinfosecurity.com/capital-one-warns-more-data...] which are becoming more and more common?

You have confirmation that internal account numbers were leaked in the capital one breach?

It says so right in the linked article.

Additionally, bank account ‘internal’ account numbers are pasted on every check that goes out and any ACH transfers also include that information, so it’s not like they are hard to cross reference with any of the other major breaches.

SSN, dob, which banks people use (and other financial institutions), which loans they have with whom, etc. also got leaked for pretty much every US adult with the equifax hack.