SAS Institute

SAS Institute, a major U.S.-based analytics and AI software manufacturer, suffered a data breach where threat actors exfiltrated old source code (dated 2003–2011), including its Business Rules Manager source code and documentation. While the stolen data is outdated—likely an old backup—the exposure of source code poses a long-term risk, as attackers could analyze it to develop exploits for future cyberattacks. Researchers warn that such breaches in leading service providers (like SAS) are increasingly used as a springboard to target their customers, amplifying potential downstream threats. The incident highlights vulnerabilities in legacy data storage and the persistent danger of source code leaks, even if the immediate operational impact appears limited.

Source: https://www.scworld.com/brief/outdated-info-pilfered-in-purported-sas-institute-breach

TPRM report: https://www.rankiteo.com/company/sas

"id": "sas4403844112125",
"linkid": "sas",
"type": "Breach",
"date": "6/2003",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'industry': ['analytics',
                                     'artificial intelligence',
                                     'software'],
                        'location': 'United States',
                        'name': 'SAS Institute',
                        'type': 'multinational corporation'}],
 'data_breach': {'data_exfiltration': True,
                 'sensitivity_of_data': 'moderate (outdated but potentially '
                                        'exploitable)',
                 'type_of_data_compromised': ['source code', 'documentation']},
 'description': 'Major U.S. multinational analytics and artificial '
                'intelligence software manufacturer SAS Institute had old data '
                'stolen by threat actors who claimed to have exfiltrated '
                'source code from its systems following an attack this month. '
                'The files are dated between 2003 and 2011, suggesting they '
                "may be old backups. The exposed data includes SAS Institute's "
                'Business Rules Manager source code and documentation. Despite '
                'the outdated nature of the files, source code exposures '
                'remain a significant threat as they could be leveraged by '
                'threat actors to create exploits for more severe '
                'cyberattacks.',
 'impact': {'brand_reputation_impact': 'potential risk due to source code '
                                       'exposure',
            'data_compromised': ['source code (Business Rules Manager)',
                                 'documentation']},
 'initial_access_broker': {'high_value_targets': ['source code',
                                                  'documentation']},
 'ransomware': {'data_exfiltration': True},
 'references': [{'source': 'Cybernews'}],
 'title': 'SAS Institute Source Code Theft Incident',
 'type': ['data breach', 'source code theft']}