Security News > 2020 > August > SANS cybersecurity training firm suffers data breach due to phishing attack
The breach compromised 28,000 records, exposing such data as names, phone numbers, physical addresses, and email addresses.
On Aug. 6, security training firm SANS Institute discovered a data breach of approximately 28,000 records as the result of one successful phishing attack against a single employee.
There is a certain alarm that a cybersecurity training firm should itself be caught in a security incident, even if due to the actions of a single employee.
"We don't know if SANS had two-factor authentication enforced, or if the attacker was able to bypass those controls if in place. It is surprising that an organization like SANS would suffer such a large breach and that the compromise was not detected until a supposedly unrelated review of email configurations was taken."
In the case of phishing attacks, training should include phishing simulations where employees are taught how to respond to suspicious emails.
News URL
Related news
- Bologna FC confirms data breach after RansomHub ransomware attack (source)
- Rhode Island confirms data breach after Brain Cipher ransomware attack (source)
- EU law enforcement training agency data breach: Data of 97,000 individuals compromised (source)
- Phishing-as-a-Service "Rockstar 2FA" Targets Microsoft 365 Users with AiTM Attacks (source)
- GenAI makes phishing attacks more believable and cost-effective (source)
- CERT-UA Warns of Phishing Attacks Targeting Ukraine’s Defense and Security Force (source)
- Inside the incident: Uncovering an advanced phishing attack (source)
- US sanctions Chinese cybersecurity company for firewall compromise, ransomware attacks (source)
- US Sanctions Chinese Cybersecurity Firm for 2020 Ransomware Attack (source)
- Texas Tech University System data breach impacts 1.4 million patients (source)