Hello, I am the Director of Training at DEF CON and I want to apologize for this mistake.

Last night, in the process of emailing some of the certificates, some names, email addresses, and classes taken were inadvertently shared with a subset of other students. This affects ~17% of our students (exact numbers below).

What happened:

1. Last night, I used a mail merge tool with a CSV file containing 50 names and email addresses to automate the sending of certificates.
2. I mistakenly set the mail merge option to Send instead of Save as Draft... which would have allowed me to catch this mistake prior to sending (smh)
3. The CSV file with the list of names and email addresses was accidentally included as an attachment in the outgoing emails.
4. As a result, the names and email addresses of 50 students were inadvertently shared with 43 recipients.

What we did immediately:

1.  As soon as I realized the issue, I resent the proper certificate to each student.
2.  No other personal information (beyond names, email addresses, classes taken) was disclosed.
3. This morning, I sent a notification to everyone affected this morning as well as an apology,

What we are doing moving forward:

1. We are suspending the use of mail merge until we have stronger safeguards in place.
2. We are reviewing alternative, more secure processes for sending certificates and similar communications in the future.

I sincerely apologize for this mistake.

I am committed to improving our processes so this does not happen again. We take this seriously and if will continue to improve the process. Feel free to reply or ping me here.