Latest / Tech Talks With Kinsoft / Reynella East College – Interlock's First Australian Victim Dumps 600GB of School Data

Transcript

Reynella East College – Interlock's First Australian Victim Dumps 600GB of School Data · Tech Talks With Kinsoft

• 0:00
  Imagine logging into your school portal on a
• 0:02
  Tuesday morning. You just want to like check
• 0:04
  a schedule or maybe look at a lunch menu. And
• 0:06
  instead you are staring down a ransom note from
• 0:09
  an international extortion syndicate. Yeah, it's
• 0:12
  completely jarring image. Right. It sounds like
• 0:14
  the plot of a bad cyber thriller. But on June
• 0:17
  9th, 2026, that was the exact reality for a community
• 0:21
  in South Australia. And that perfectly encapsulates
• 0:24
  why we are looking so closely at this today.
• 0:27
  I mean, we are dissecting the breach at Raynella
• 0:29
  East College, which was executed by the ransomware
• 0:32
  cartel known as Interlock. A completely massive
• 0:34
  incident. Huge. And our mission for this deep
• 0:37
  dive is to extract the actual operational reality
• 0:40
  from this crisis. We are going to look at how
• 0:43
  threat actors bypass million -dollar defenses,
• 0:46
  how they hoard data, and ultimately... how they
• 0:49
  weaponize the very systems designed to protect
• 0:51
  us. OK, let's unpack this, because the timeline
• 0:53
  of how this attack unfolded is just so deceptive.
• 0:56
  It really is. Ground zero for the public is early
• 0:58
  June. So Ronella East College is a massive P
• 1:02
  -12 public school down in Adelaide. We are talking
• 1:05
  preschool all the way up to year 12, over 1 ,900
• 1:08
  students, including international enrollees.
• 1:11
  So a really huge administrative footprint. Massive
• 1:14
  amounts of data. Exactly. So on June 9th, Parents
• 1:17
  get a notification about a, quote, cybersecurity
• 1:20
  breach. All ICT systems are pulled offline. Right.
• 1:24
  And for about a week, the school and the Department
• 1:26
  for Education are just in complete blackout mode
• 1:29
  trying to figure out what actually happened.
• 1:31
  But reading through the logs and the public statements
• 1:34
  we have, it seems like the immediate community
• 1:36
  reaction was essentially just, oh, the servers
• 1:38
  are acting up again. Yeah, a lot of denial. Right.
• 1:40
  There's this assumption of a temporary disruption.
• 1:43
  But honestly, whenever an organization goes dark
• 1:46
  for days and says cyber incident, I immediately
• 1:49
  assume the worst. I mean, is it ever just an
• 1:51
  outage anymore or is that initial quiet period
• 1:54
  just organizations praying the house wasn't completely
• 1:57
  robbed? Honestly, it's almost always the latter.
• 2:01
  And it stems from a pretty fundamental misunderstanding
• 2:03
  of how modern network infiltration actually works.
• 2:07
  How so? Well, when the sisters went offline on
• 2:10
  June 9th, that was not the beginning of the attack.
• 2:13
  That was the grand finale. But the grand finale,
• 2:15
  so they had already been inside for weeks. Yeah,
• 2:18
  exactly. The industry term for this is dwell
• 2:20
  time. Attackers don't just, you know, kick down
• 2:23
  the door, encrypt your files and leave a note
• 2:25
  in five minutes. Right. It's much more like a
• 2:27
  burglar getting a job as the night janitor in
• 2:30
  your building. They spend weeks, sometimes months,
• 2:33
  just walking the halls with their mop and bucket.
• 2:35
  It's quietly looking around. Exactly. Yeah. They
• 2:38
  are quietly mapping the network topology, figuring
• 2:42
  out where the domain controllers are, locating
• 2:44
  the digital vaults, and critically, hunting down
• 2:47
  the network backups so they can destroy them
• 2:49
  first. Wow. So they take out the safety net before
• 2:51
  they even strike. Right. And they exfiltrate
• 2:54
  the data slowly. So they don't trigger any bandwidth
• 2:56
  alarms. Deploying the ransomware that actually
• 2:59
  locks everyone out is literally the last button
• 3:01
  they press on their way out the door. So by the
• 3:03
  time the parents got that email on June 9th,
• 3:05
  the ghost was already out of the machine. The
• 3:08
  data was gone. It was long gone. Which is why
• 3:10
  exactly 14 days later on June 23rd, the whole
• 3:14
  facade of a mere disruption completely evaporated.
• 3:17
  Right. Because Interlock listed the school on
• 3:20
  its dark web leak site and just started publishing
• 3:23
  the stolen data. Yeah. They made it incredibly
• 3:25
  public. And this is where I have to like call
• 3:28
  a timeout and look at the actual claims being
• 3:30
  made because the numbers Interlock threw out
• 3:31
  there made me immediately skeptical. The file
• 3:34
  sizes. Yeah. They claimed they stole 610. gigabytes
• 3:38
  of data for a single public school. I mean, over
• 3:42
  473 ,000 files across 68 ,000 folders. That just
• 3:47
  sounds completely absurd. Is that even physically
• 3:49
  plausible or are they just making up terrifying
• 3:51
  numbers to trigger a panic? What's fascinating
• 3:53
  here is that you are picking up on the exact
• 3:56
  psychological warfare tactic these cartels rely
• 3:59
  on. So it is fake. Well, it's asymmetric information.
• 4:02
  You have to remember, neither the school's forensic
• 4:05
  teams nor independent security analysts have
• 4:08
  been able to verify that 610 gigabyte figure.
• 4:11
  Okay, so it's unconfirmed. Highly unconfirmed.
• 4:13
  In fact, third -party reviewers explicitly stated
• 4:17
  they couldn't validate the total volume. Interlock
• 4:20
  throws out a massive, terrifying number because
• 4:22
  they know the school's IT department is still
• 4:25
  scrambling to figure out what was even touched.
• 4:27
  It's a pure negotiation tactic. I mean, they
• 4:29
  want the school board in a blind panic, thinking
• 4:32
  everything from the last 20 years is out there
• 4:34
  just so they pay the ransom faster. Precisely.
• 4:37
  We have to treat that 610 gigabyte claim as a
• 4:40
  weaponized bluff. Both things can be true simultaneously,
• 4:43
  right? The breach is catastrophic and real, but
• 4:47
  the criminal's specific claims are highly inflated
• 4:49
  for leverage. Okay, so if we table their inflated
• 4:52
  marketing numbers, let's talk about what the
• 4:54
  independent reviewers did find in the initial
• 4:56
  data dumps. Because frankly, the verified reality
• 4:59
  is plenty horrifying on its own. It really is.
• 5:02
  I mean, the security journalists who analyzed
• 5:03
  the leaked materials confirmed the presence of
• 5:06
  highly sensitive files. We are talking about
• 5:08
  school budgets, teaching documents, extensive
• 5:11
  contact details for students and their families.
• 5:14
  And the passports. Yeah, they found high -resolution
• 5:16
  passport scans belonging to international students
• 5:19
  and teaching staff. And then there's the technical
• 5:21
  failure that completely blew my mind, the plain
• 5:23
  text password. Yes, just lists of network passwords
• 5:26
  stored right next to their corresponding usernames.
• 5:29
  Completely unincre - I genuinely cannot comprehend
• 5:32
  that. We are talking about a major institution
• 5:34
  in 2026. No hashing, no salting, no secure credential
• 5:39
  management whatsoever. Just raw text sitting
• 5:43
  in a directory. Yeah, it's bad. I mean, storing
• 5:45
  passwords in plain text next to usernames is
• 5:48
  literally like taping your ATM PI in the front
• 5:51
  of your debit card and leaving it on a park bench.
• 5:53
  It completely invalidates the entire concept
• 5:55
  of network security. It does. And when attackers
• 5:57
  uncover a spreadsheet or a directory of plain
• 6:00
  text credentials, the infiltrate. phase is essentially
• 6:03
  over. Because they just have the keys to the
• 6:05
  castle. Exactly. They don't have to exploit software
• 6:08
  vulnerabilities or write custom malware to move
• 6:10
  laterally through the system anymore. They just
• 6:12
  log in. They use those valid credentials to open
• 6:15
  every other door in the network. It turns a localized
• 6:18
  compromise into a total systemic collapse. And
• 6:21
  think about your own digital footprint right
• 6:23
  now for everyone listening. How many former employers
• 6:27
  or how many gyms, travel agencies, landlords
• 6:30
  currently have a scan of your passport or your
• 6:33
  driver's license just sitting on some forgotten
• 6:35
  server? It's a scary thought. Because once it's
• 6:38
  on a shared drive, it is just waiting for someone
• 6:40
  to find it. And if we connect this to the bigger
• 6:42
  picture, it really forces us to look at the gap
• 6:44
  between our assumptions of safety and the operational
• 6:47
  reality of how data is handled. We're living
• 6:50
  in an ecosystem that inherently encourages data
• 6:53
  hoarding. Because storage is basically free now.
• 6:55
  Exactly. Organizations collect massive amounts
• 6:58
  of identity metrics because storage is cheap,
• 7:00
  but they completely lack the administrative discipline
• 7:03
  to ever purge it. Which brings us to the threat
• 7:05
  actors who are exploiting that exact lack of
• 7:08
  discipline. For a long time, there was this prevailing
• 7:11
  idea, a sort of naive optimism, that hackers
• 7:15
  had boundaries. Right. That places like schools,
• 7:18
  hospitals, charities were largely off limits
• 7:21
  because there was no financial upside. Or maybe
• 7:23
  just a baseline level of human decency. Yeah,
• 7:26
  the lazy comfort of assumed immunity. Yes. That
• 7:29
  assumption is definitively dead. The reality
• 7:32
  is that ransomware operators like Interlock have
• 7:35
  absolutely zero moral compass. They are hyper
• 7:38
  rational opportunists. They just want the money.
• 7:41
  They do not care about the societal value of
• 7:43
  the institution at all. They only care about
• 7:45
  the intersection of vulnerability and leverage.
• 7:47
  And a school sits perfectly at that intersection.
• 7:50
  They are notoriously underfunded when it comes
• 7:52
  to enterprise grade IT infrastructure, but they
• 7:54
  hold incredibly rich, heavily regulated data.
• 7:57
  Right. The leverage is huge. The leverage to
• 7:59
  pay the ransom to protect the kids is. astronomical.
• 8:02
  Exactly. But how they actually break in is what
• 8:05
  organizations really need to understand because
• 8:07
  it completely shatters the Hollywood myth of
• 8:10
  the hacker. Right. It's not green code raining
• 8:13
  down a screen. No, not at all. Interlock didn't
• 8:16
  burn a million dollar zero day exploit to get
• 8:19
  into Brunella East College. They used social
• 8:22
  engineering, specifically a fake. verify your
• 8:26
  human pop -up. I saw that in the sources, and
• 8:29
  I need you to explain the mechanics of this,
• 8:30
  because I think a lot of people hear fake CapyCHA
• 8:33
  and assume it just steals your password if you
• 8:35
  type it in. Right, like a phishing page. Yeah.
• 8:37
  But this bypassed modern endpoint security, how
• 8:41
  does clicking a fake CapyCHA give an attacker
• 8:45
  a permanent foothold? It's brilliantly insidious
• 8:48
  because it weaponizes our daily friction. You
• 8:51
  land on a compromised website or maybe open a
• 8:53
  malicious HTML attachment and you get a pop -up
• 8:55
  that looks exactly like a standard Cloudflare
• 8:58
  or Google Cappy CCHA. Just a normal, annoying
• 9:01
  internet hurdle. Exactly. It says verify you
• 9:04
  are human to view this document, but instead
• 9:06
  of clicking a traffic light or a crosswalk, it
• 9:08
  gives you a sequence of keyboard commands to
• 9:10
  prove you aren't a bot. Like pressing Windows
• 9:12
  plus R, pasting something, and hitting enter.
• 9:15
  Exactly. When you click the initial verify button,
• 9:18
  the malicious site silently copies a heavily
• 9:21
  obfuscated PowerShell script directly to your
• 9:23
  computer's clipboard. Oh, wow. The subsequent
• 9:26
  instructions, pressing Windows and R and hitting
• 9:28
  enter, that basically tricks the user into opening
• 9:31
  their own terminal and executing the malicious
• 9:34
  code directly from their own clipboard. Here's
• 9:36
  where it gets really interesting. So it's not
• 9:38
  even a software exploit. It is entirely exploiting
• 9:41
  muscle memory and human fatigue. That is the
• 9:44
  core of it. And this is exactly why it bypasses
• 9:47
  millions of dollars in enterprise security. Your
• 9:50
  endpoint detection and response software, your
• 9:52
  firewalls, they don't see an external threat
• 9:55
  trying to force its way in. Because it's coming
• 9:57
  from inside the house. Precisely. They see a
• 9:59
  legitimately authenticated user sitting at their
• 10:02
  authorized workstation, actively executing a
• 10:05
  command. The security tools inherently trust
• 10:08
  the human, and the human has been tricked into
• 10:10
  opening the door from the inside. So if perimeter
• 10:13
  defense is essentially failing because it's so
• 10:15
  easy to engineer human error, the fallback strategy
• 10:18
  has to be what's actually sitting on the servers
• 10:21
  when they inevitably get in. Absolutely. Which
• 10:24
  pivots us from just admiring the problem to actually
• 10:27
  fixing it. Looking at this specific disaster.
• 10:30
  What are the concrete operational lessons you
• 10:33
  can take back to your own teams? There are three
• 10:35
  non -negotiable lessons we can extract from this.
• 10:38
  The first is accepting your status as a target.
• 10:41
  Right. If anyone in your organization is still
• 10:43
  saying, oh, we're a small firm or we just do
• 10:45
  public administration, no one wants our data,
• 10:47
  you have to kill that culture immediately. Because
• 10:50
  it's not a guy in a hoodie specifically choosing
• 10:52
  to target your local school. It's just automated
• 10:54
  scanning, right? Precisely. Interlock operates
• 10:57
  on scale. They deploy automated scripts that
• 10:59
  just scour the global internet 24 -7 looking
• 11:02
  for an unpatched VPN, a misconfigured remote
• 11:05
  desktop protocol, or a susceptible user. I don't
• 11:09
  care who you are. They don't even know who you
• 11:10
  are until the script alerts them that a door
• 11:13
  just opened. If you have an internet connection,
• 11:16
  you are on the target list. Okay, so target acceptance
• 11:19
  is lesson one. Lesson two seems to be the one
• 11:22
  that Rinella East College failed most catastrophically,
• 11:25
  which is data hygiene is your actual defense.
• 11:28
  Yes, data minimization is the only true defense
• 11:32
  against extortion. Think about the passports
• 11:35
  found in this leak. Yeah, that's the scariest
• 11:37
  part. You can reset a compromised password in
• 11:40
  30 seconds. You can issue a new credit card in
• 11:42
  a week. But a passport scan. That contains your
• 11:46
  legal name, your date of birth, your place of
• 11:49
  birth, your biometric photo. You cannot rotate
• 11:51
  a birth certificate. No, it's permanent infrastructure
• 11:53
  for your identity. I mean, if that leaks, you
• 11:56
  are exposed to synthetic identity fraud for the
• 11:59
  rest of your life. Which is exactly why organizations
• 12:01
  have to stop treating server space like a digital
• 12:03
  attic. Every listener should literally walk into
• 12:06
  their next management meeting and ask, do we
• 12:08
  actually need to retain these passport scans?
• 12:11
  Right. If we only needed them to verify identity
• 12:13
  at enrollment, why are they still in the server
• 12:15
  three years later? Exactly. Is the data encrypted
• 12:18
  at rest? Who actually has access permissions
• 12:20
  to that folder? If you don't need it, destroy
• 12:22
  it. If you reduce the blast radius of a breach,
• 12:26
  you remove the attacker's leverage entirely.
• 12:28
  And that leads perfectly into the third lesson,
• 12:30
  which is about managing the crisis itself when
• 12:33
  that blast radius is actually realized. How do
• 12:36
  you navigate the immediate aftermath without
• 12:38
  completely destroying public trust? It requires
• 12:41
  a massive amount of operational discipline, really,
• 12:43
  to manage the gap between criminal claims and
• 12:47
  forensic reality. We saw this exact same dynamic
• 12:50
  play out with a regional fire service just two
• 12:52
  weeks before the school attack. Right. I remember
• 12:54
  that. The attackers claim they stole a terabyte
• 12:57
  of sensitive dispatch data. The media picks up
• 12:59
  the terrifying number and the organization is
• 13:02
  caught flat footed because their IT team needs
• 13:04
  like three weeks to do a proper forensic audit.
• 13:07
  And that three week window is where trust is
• 13:09
  either maintained or destroyed. The mandate for
• 13:12
  leadership is to resist panic and equally to
• 13:15
  resist denial. So you have to be straight with
• 13:17
  people. You have to investigate methodically.
• 13:20
  When you communicate with your stakeholders,
• 13:22
  you state exactly what you know to be true. But
• 13:25
  more importantly, you must be ruthlessly transparent
• 13:27
  about what you don't yet know. So no corporate
• 13:31
  speak. No, we take your privacy seriously while
• 13:35
  we look into a minor disruption. Never downplay
• 13:37
  it. If you say it's a minor disruption and then
• 13:40
  two weeks later passports are on the dark web,
• 13:42
  you will never regain the trust of that community.
• 13:45
  You own the uncertainty early so you can own
• 13:48
  the narrative later. It seems like the overarching
• 13:50
  theme here is proactive auditing. Getting your
• 13:53
  house in order before the burglars realize you
• 13:56
  left the window open? It has to be. And there
• 13:58
  are entire sectors of the cybersecurity industry
• 14:00
  dedicated to this now. I know the author of the
• 14:03
  source material pointed to companies like Kinsoft,
• 14:05
  who specialize in exactly this. They come in,
• 14:08
  run automated audits of your shared drives, flag
• 14:11
  the plain text passwords, find the five -year
• 14:13
  -old passport scans, and basically force you
• 14:15
  to clean it up. Because the harsh reality of
• 14:17
  the current threat landscape is that an audit
• 14:20
  is going to happen to your network this year.
• 14:22
  Will you like it or not? Exactly. The only choice
• 14:24
  you get to make is whether that audit is conducted
• 14:26
  by a hired security firm or by an international
• 14:29
  extortion cartel. Once the data leaves your physical
• 14:32
  building, you have permanently lost control of
• 14:35
  the safety of the people who trusted you. So
• 14:38
  let's summarize the domino effect we've mapped
• 14:40
  out today. It starts with a completely mundane
• 14:42
  human action, a staff member tiredly clicking
• 14:46
  through a fake verify your human prompt. That
• 14:49
  muscle memory mistake hands an attacker a foothold.
• 14:52
  They quietly map the network, locate the digital
• 14:55
  gold mine of student passports and unencrypted
• 14:58
  passwords, pull it all out, and just slam the
• 15:00
  door shut behind them with ransomware. A nightmare
• 15:02
  scenario. And suddenly, a week of operational
• 15:06
  blackout turns into a permanent dark web exposure.
• 15:09
  It's a stark reminder that being technologically
• 15:12
  informed isn't just about reading the news. It's
• 15:14
  about looking critically at your own digital
• 15:16
  footprint, your own organization's shared drives,
• 15:20
  and asking, what old scams am I leaving in my
• 15:23
  forgotten folders? And who are we putting at
• 15:25
  risk by keeping them? And if I can leave you
• 15:28
  with one final thought to consider about all
• 15:29
  of this. Please do. Breaches like this one at
• 15:32
  Ranella East College are ushering in an entirely
• 15:34
  unprecedented societal shift. We are now looking
• 15:38
  at an entire generation of children, Gen Alpha,
• 15:41
  Gen Z, who will have their permanent, unchangeable
• 15:44
  identity metrics compromised before they even
• 15:46
  learn to drive. Passports, detailed medical histories,
• 15:50
  behavioral records, these are being permanently
• 15:52
  indexed on the dark web while they are still
• 15:54
  in primary school. We really need to ask ourselves,
• 15:57
  what does it mean for our society when the very
• 15:59
  concept of starting adulthood with a clean slate
• 16:02
  is technically impossible? That's incredibly
• 16:04
  bleak. These kids are inheriting pre -compromised
• 16:07
  digital lives, and it is entirely due to the
• 16:10
  data hygiene failures of the institutions that
• 16:12
  were explicitly designed to protect them. That
• 16:15
  is a deeply unsettling reality and a perfect
• 16:18
  place to wrap up today's analysis. Thank you
• 16:20
  for joining us on this deep dive. Stay patched
• 16:22
  and stay skeptical.