Thread by @BleepinComputer

SANS infosec training org suffers data breach after phishing attack - @LawrenceAbrams
bleepingcomputer.com/news/security/…

In a 'Data Incident' incident notification, SANS states they discovered that one of their employees' email accounts was compromised during a phishing attack.

As part of this attack, a malicous Office 365 addon (most likely an Oauth app) was installed and a rule was created to forward incoming mail to an unknown external email address.

For more information about malicious Office 365 Oauth apps:
bleepingcomputer.com/news/security/…

As part of this compromise, a total of 513 emails were forwarded, containing a total of approximately 28,000 records of personal information (PII).

This information includes email addresses, full names, phone numbers, work title, company names, and physical addresses. It did not contain any financial info or passwords.

SANS' digital forensics instructors will be performing the investigation, and at the end, will host a webinar to share their findings with the rest of the cybersecurity community. Should be an interesting learning experience for many.

SANS notification can be found here:
sans.org/dataincident20…