The Capital breach timeline doesn't add up