SANS Institute, which drills cyber professionals in defense, suffers data breach

A phishing email led to 28,000 PII records being exposed.

The SANS Institute, which trains cybersecurity professionals around the world, was hacked, resulting in the compromise of 28,000 records of personally identifiable information, the organization said Tuesday.

The Maryland-based research and educational outfit said the breach was the result of a single phishing email sent to a SANS employee, which led to more than 500 of the organization’s emails being forwarded. The breached data included names, email addresses, and physical addresses — information submitted by attendees of a recent SANS virtual training event.

After discovering the breach on Aug. 6, SANS said it “quickly stopped any further release of information” from the compromised email account, which was forwarding the data to an “unknown external email address.” The institute did not identify who was responsible for the hack.

“We are investigating this incident with the support of some of the world’s top forensic experts to be certain that we understand the complete scope of what was accessed,” SANS said in an email to victims of the breach obtained by CyberScoop.

SANS, which says it reaches 165,000 security professionals around the world, is renowned for its training in cyber incident response and penetration testing. The institute has trained countless people in prominent positions at corporations, and has also run cybersecurity exercises for U.S. military personnel. Becoming a SANS instructor is a badge of honor in the cybersecurity industry, and some U.S. government and corporate employees moonlight as instructors.

“[We] deeply regret this attack has happened,” SANS said in its notification email. “When the investigation is complete, we will run a webcast to outline our learnings if there is information that we think would be useful to the community.”

There was no evidence the stolen data had been abused, “but please do be extra careful if you receive any unsolicited communications, particularly if they claim to be from either SANS Institute or GIAC Certifications,” the email said, referring to a global security accreditation run by SANS.

After news of the breach broke, some cybersecurity hands noted the irony of the training guru getting hacked.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure