Hackers claim SAS Institute, but researchers are not so sure

Attackers are claiming that they’ve obtained source code from analytic software maker SAS Institute. However, the Cybernews research team believes the data sample the attackers shared is likely outdated.

Malicious actors claimed responsibility for the attack on the analytics software maker on a popular hacking forum, which is used to distribute stolen details. The attackers claim that the company suffered a data breach sometime in November, which allowed them to access the company’s source code and tools.

After the article was published, SAS issued a security bulletin saying the company investigated attacker claims and came to the conclusion that the company's source code was not exposed.

“SAS determined that the surfaced data was comprised of publicly accessible files published by SAS Technical Support. SAS believes that the data in question poses no risk to SAS or SAS customers,” the company said.

Meanwhile, the Cybernews research team has investigated the data sample attackers attached to the post. Our team noted that the data appears to include internal company Business Rules Manager source code and its documentation.

“It is crucial to note that these files are old, with dates ranging from 2003 to 2011. This indicates that the supposed source code might be an old backup, minimizing the impact of the leak significantly,” they explained.

Our researchers also noted that while the data is old, not all companies regularly update their backups. However, as SAS Institute is a global, multi-billion-dollar company, it is highly unlikely that this was the case.

However, source code leaks are dangerous as this type of data severely exposes companies’ vulnerabilities. Malicious actors can use the leaked source code information to develop dedicated exploits that facilitate further attacks.

In the case of SAS Institute, source code leaks could prove extremely hazardous as the company provides tools to manu organizations around the world. Attackers often utilize large service providers to target their clients.

SAS Institute is a major analytics and AI software provider. The company’s reported revenue exceeds $3 billion, with over 12,000 employees under its roof. SAS Institute caters to the healthcare, finance, and government sectors.

Updated on November 21st [07:20 a.m. GMT] with a statement from SAS Institute.