The SANS Institute, a company that provides cybersecurity training and certification, announced that a data breach compromised the personally identifiable data of roughly 28,000 records. The breach has been traced back to a phishing attack that targeted an employee of the company.
Describing itself as “the most trusted and by far the largest source for information security training in the world,” SANS stated in their announcement of the breach on August 6 that they “identified a suspicious forwarding rule” in their email configuration.
“513 emails were forwarded to a suspicious external email address. Most of these emails were harmless, but some of these emails contained files with personally identifiable information (PII). As a result, approximately 28,000 records of PII were forwarded to a suspicious external email address,” the company stated, adding that they have “have identified a single phishing e-mail as the vector of the attack.”
The successful breach of an industry leader demonstrates the threat posed by social engineering, which focuses on gaining access to a network by deceiving employees rather than deploying more sophisticated means. The recent hack of several high-profile Twitter accounts used a similar approach.
