Capital One looked to the cloud for security. But its own firewall couldn’t stop a hacker.