Latest / Tech Talks With Kinsoft / 447GB Exposed: The Kelly Legal Breach and Emerging November Threats

Transcript

447GB Exposed: The Kelly Legal Breach and Emerging November Threats · Tech Talks With Kinsoft

• 0:00
  Hello and welcome to Tech Talks with Kinsoft.
• 0:02
  It is Thursday, the 5th of February, 2026. I'm
• 0:06
  your host and, uh... I have to say what we're
• 0:09
  unpacking today has me sort of nervously double
• 0:12
  checking my own passwords. It has that effect
• 0:14
  on people. It really does. We're looking at a
• 0:17
  series of events from late last year that have
• 0:18
  just sent shockwaves through the Australian professional
• 0:21
  services industry. But before we get into the,
• 0:25
  you know, the nitty gritty, I want you to imagine
• 0:27
  something. Imagine you walk into your office.
• 0:29
  It's a Tuesday morning. You've got your coffee.
• 0:32
  You sit down. You wiggle the mouse and just.
• 0:35
  Black screen, nothing. So you pick up your desk
• 0:37
  phone to call IT. Dead air. Dead air. You check
• 0:39
  the Wi -Fi on your mobile. Connection refused.
• 0:42
  The only way you can tell your clients you even
• 0:44
  still exist is to post on your personal Facebook
• 0:46
  page. Which is, I mean, that is the exact nightmare
• 0:48
  that played out for a Queensland law firm just
• 0:51
  a few months ago. Exactly. That's our starting
• 0:53
  point today. The Kelly legal data breach from
• 0:56
  late 2025. But I want to be really clear. This
• 0:59
  is not just a story about one law firm. If you're
• 1:02
  listening and thinking, oh, well, I don't run
• 1:04
  a law firm in Queensland. I'm fine. You are missing
• 1:06
  the bigger picture here. You absolutely are.
• 1:09
  This is a story about a tactical shift. What
• 1:11
  we're seeing. and the data backs this up, is
• 1:14
  a targeted campaign. We're not talking about
• 1:16
  random attacks anymore. We're talking about snipers.
• 1:19
  Snipers. I like that analogy. So, OK, let's get
• 1:21
  into the anatomy of this thing. Yeah. Take us
• 1:23
  back to October 2025. How does a disaster like
• 1:27
  this actually begin? It began with that silence
• 1:29
  you described. On October 10th, Kelly Legal posted
• 1:32
  on Facebook calling it an IT and phone system
• 1:35
  blackout. A blackout. See, that sounds almost
• 1:38
  manageable, like a power outage. Right. It sounds
• 1:40
  technical, maybe fixable. That's often the denial
• 1:43
  phase. But later that day, the story changed.
• 1:45
  They confirmed it was a hacking incident. But
• 1:48
  there was one line in their warning to clients
• 1:50
  that was just a massive red flag. I've got it
• 1:52
  here. They told clients to, quote, verify bank
• 1:55
  account details by phone before acting on any
• 1:58
  requests for funds. Exactly. Now, stop and think
• 2:02
  about that. If your system is just encrypted
• 2:04
  or offline, why are you so worried about bank
• 2:07
  details? Well, they're worried about fraud, I
• 2:09
  assume? Someone tricking their clients? It's
• 2:12
  more specific. It screams business email compromise.
• 2:16
  It means they feared the hackers weren't just
• 2:18
  outside the walls locking the doors. They were
• 2:21
  inside. Inside the email system. So what does
• 2:23
  that mean exactly? Payment redirection. It's
• 2:25
  like a thief standing at your mailbox, steaming
• 2:28
  open your invoices, changing the bank account
• 2:30
  details to their own, and then sealing it back
• 2:32
  up. The client pays what looks like a legitimate
• 2:34
  bill. And the money just vanishes. So Kelly Legal
• 2:37
  was fighting a war on two fronts. Get their systems
• 2:40
  back and stop their clients from accidentally
• 2:42
  wiring money to criminals. And that's a terrifying
• 2:45
  position to be in. But the really big shoe didn't
• 2:48
  drop for another month. November 13th. That's
• 2:51
  when the group behind it all, INC Ransom, listed
• 2:54
  Kelly Legal on their Darknet leak site. Listed?
• 2:57
  That sounds so clinical. It's a trophy wall.
• 2:59
  It's where they post the proof. And they claim
• 3:01
  to have exfiltrated 447 gigabytes of data. Okay,
• 3:06
  let's drill down on that. 447 gigs. To some people
• 3:09
  listening, that might not sound like a lot in
• 3:11
  a world of 4K movies. But for a law firm, what
• 3:15
  is that? It is colossal. We're talking about
• 3:18
  documents, PDFs, Word files. They're tiny. To
• 3:21
  get to 447 gigs, you're talking about hundreds
• 3:24
  of thousands of files. It's the entire firm.
• 3:27
  Contracts, financial data, HR files, customer
• 3:30
  data. The HR files. That's the part that makes
• 3:33
  my skin crawl. It's not just rich clients. It's
• 3:35
  the staff, their personal information. It's the
• 3:37
  crown jewels of confidentiality. And this is
• 3:40
  the core of INC Ransom's business model. It's
• 3:43
  what we call double extortion. Walk us through
• 3:44
  that. Okay, so step one, encrypt all the data.
• 3:47
  The firm grinds to a halt. You can't work. That's
• 3:50
  operational panic. Right. Step two, steal a copy
• 3:53
  of all that data and threaten to leak it publicly.
• 3:55
  Now you have reputational panic. Because for
• 3:57
  a law firm, your reputation is everything. If
• 3:59
  I can't trust you with my secrets, I can't hire
• 4:01
  you. You've hit the nail on the head. INC Ransom
• 4:03
  knows this. They are leverage experts. They know
• 4:07
  a firm can probably survive a week of downtime.
• 4:10
  They absolutely cannot survive a total breach
• 4:12
  of client confidentiality. So who are these people?
• 4:15
  Who is INC Ransom? They seem to have just exploded
• 4:18
  onto the scene. They're relatively new, yeah.
• 4:20
  First seen around August 2023. But they are very,
• 4:25
  very good at what they do. They hit North America,
• 4:27
  Europe. but they have developed a real taste
• 4:31
  for Australian organizations. So we're not just
• 4:33
  a sideshow for them. Not at all. Remember early
• 4:36
  last year, early 2025, the attack on Spectrum
• 4:39
  Medical Imaging in Sydney? Vaguely. That was
• 4:42
  the one with patient records. That was them.
• 4:44
  That was INC Ransom. So you see the pattern.
• 4:46
  First medical records, now sensitive legal files.
• 4:48
  They're systematically targeting sectors with
• 4:51
  high -value, high -leverage data. And how are
• 4:53
  they getting in? Is it some brute force, Mission
• 4:55
  Impossible -style hack? It's usually much quieter.
• 4:58
  Their signature is spear phishing. Okay, so spear
• 5:00
  phishing. Different from the normal phishing
• 5:03
  emails we all get about a Nigerian prince. Very
• 5:06
  different. Normal phishing is like casting a
• 5:08
  wide net. Spearfishing is hunting with a sniper
• 5:11
  rifle. It's not a generic email. It's an email
• 5:13
  that says, hi, Sarah, just following up on the
• 5:15
  Johnson settlement. Attached is the revised contract.
• 5:18
  So it knows her name. It knows a file she's working
• 5:20
  on. Exactly. They do their homework. They look
• 5:23
  at LinkedIn. They read your website. Maybe they've
• 5:25
  already compromised a vendor you work with. The
• 5:27
  emails are targeted. They're researched. And
• 5:29
  they are incredibly hard to spot. That is genuinely
• 5:32
  unnerving. And it brings us to the next point,
• 5:34
  because Kelly Legal. As bad as it was, it wasn't
• 5:37
  an isolated case, was it? Not even close. If
• 5:40
  you zoom out and look at that whole period in
• 5:42
  late 2025, it was. Well, it was open season on
• 5:46
  Australian professional services. Yeah, you sent
• 5:48
  me the list. It wasn't just them. Far from it.
• 5:50
  You had Bryden's lawyers in Sydney. Hackers claimed
• 5:53
  600 gigs of data from them. You had Skeggs Goldstein,
• 5:57
  a financial services firm in NSW, hit by a different
• 6:00
  group, Kwylan. For 500 gigs. So why? Why these
• 6:04
  mid -sized Australian firms? Why not go for the
• 6:07
  big banks, you know, Telstra? Because a big bank
• 6:10
  is like Fort Knox. They have billion -dollar
• 6:12
  security budgets. A mid -sized law firm, on the
• 6:15
  other hand, is the Goldilocks target. The Goldilocks.
• 6:19
  They're big enough to have money and be able
• 6:20
  to pay a hefty ransom. They hold incredibly sensitive
• 6:23
  data. But they're small enough that their IT
• 6:27
  security might not be military grade. It's the
• 6:30
  path of least resistance. for the biggest reward
• 6:32
  and the most leverage the most leverage is blackmail
• 6:35
  pure and simple but this is where the story gets
• 6:38
  even bigger it's not just about who these firms
• 6:40
  are it's about who they work for it's the supply
• 6:42
  chain okay so this is where it goes from being
• 6:44
  a business problem to potentially a national
• 6:47
  security problem precisely let's talk about icad
• 6:50
  engineering right the defense supplier an australian
• 6:52
  defense supplier late 2025 they get listed by
• 6:56
  a group called j group And we are not talking
• 6:58
  about divorce settlements anymore. We're talking
• 7:00
  Hunter class frigates, Collins class submarines.
• 7:04
  And the hackers claimed they had access to ICAD
• 7:07
  systems for five months. Wait, what? Five months?
• 7:10
  Just sitting inside their network? Just sitting
• 7:12
  there, watching, downloading. And do you know
• 7:16
  how they allegedly got in? I'm almost afraid
• 7:18
  to ask. An outdated VPN vulnerability. A VPN.
• 7:22
  The very thing that's meant to keep you secure.
• 7:24
  It keeps you secure if you keep it updated. If
• 7:27
  it has a known hole and you don't patch it, it's
• 7:29
  not a secure tunnel. It's an open door that you've
• 7:32
  just left unlocked. So the hackers didn't have
• 7:35
  to be geniuses. They just had to rattle the doorknobs
• 7:37
  on the street until one opened. Essentially.
• 7:39
  But see, the strategy. They didn't attack the
• 7:41
  Australian Navy. They attacked the engineering
• 7:43
  firm that works for the Navy. A side door. It's
• 7:45
  the supply chain attack. We saw it again with
• 7:47
  the Army's redback program, the armored vehicles.
• 7:50
  Right. Another group published the designs for
• 7:52
  those, didn't they? A group called CyberTufan.
• 7:54
  Link to. Iran. And again, they didn't hack the
• 7:58
  Australian army. They hacked the contractors
• 8:01
  in the supply chain. So the lesson here is that
• 8:04
  you're a target not just for what you have, but
• 8:06
  for who you know. That is the single most important
• 8:08
  takeaway. You might think you make boring bolts
• 8:11
  for a living, but if those bolts go into a submarine,
• 8:14
  you're not a boring target anymore. You are a
• 8:17
  stepping stone. Which is a really sobering thought.
• 8:20
  And the tools they're using to find these stepping
• 8:22
  stones are getting... Well, scarily smart. Let's
• 8:26
  talk about the AI. Oh, yeah. This is the real
• 8:28
  game changer. Those reports from Google and Anthropic
• 8:31
  late last year were eye opening. For years, the
• 8:34
  advice for spotting a phishing email was look
• 8:37
  for bad grammar. Right. Kindly do the needful.
• 8:40
  That was always the giveaway. That safety net
• 8:42
  is gone. Yeah. Hackers are now using large language
• 8:45
  models, AI, to write perfect, persuasive, context
• 8:48
  -aware business English. So that hyper -targeted
• 8:51
  spear phishing we talked about. Is now being
• 8:53
  automated and scaled. An AI can scan your LinkedIn,
• 8:56
  read your company's last press release, and then
• 8:59
  draft an email to you that is indistinguishable
• 9:01
  from one written by a real colleague. It can
• 9:03
  do it a thousand times a minute. So the barrier
• 9:06
  to entry for being a sophisticated attacker is
• 9:08
  just... dropping through the floor. It's dropping
• 9:11
  fast. And while the big AI companies were trying
• 9:14
  to build in safety rails, the criminals are just
• 9:17
  running their own models on what's called bulletproof
• 9:19
  hosting. Bulletproof hosting? Explain that. It
• 9:21
  sounds like something out of a spy movie. It's
• 9:23
  basically a web hosting service that promises
• 9:25
  not to take your site down no matter what. They're
• 9:28
  often in jurisdictions that don't cooperate with
• 9:30
  law enforcement. It's where the ransomware groups
• 9:33
  host their leak sites and command centers. And
• 9:36
  the government's trying to fight this. I saw
• 9:37
  they issued some sanctions. They are, yes. In
• 9:39
  November, Australia, the U .K. and the U .S.
• 9:43
  sanctioned some Russian individuals and companies
• 9:45
  providing these services. It's a good step. It
• 9:47
  creates friction for the criminals. But it's
• 9:49
  not a silver bullet. It's a game of whack -a
• 9:51
  -mole. You shut one down, they pop up under a
• 9:54
  new name. The criminals are agile. So let's bring
• 9:57
  this all home. If the government can't stop it
• 9:59
  overnight and the bad guys have AI, what can
• 10:02
  the average person or business actually do? What's
• 10:05
  the actionable advice here? It means we have
• 10:08
  to change our fundamental behavior. We have to
• 10:11
  move away from a position of default trust in
• 10:14
  digital communication. Okay, so let's get specific.
• 10:18
  I'm a client. My lawyer emails me new bank account
• 10:22
  details for a house deposit. What do I do? You
• 10:24
  pick up the phone. And you call a number you
• 10:27
  know is correct from their website or an old
• 10:30
  letter, not the number in the email signature.
• 10:32
  Because the hacker could have changed that too.
• 10:34
  Of course. You call and you get them to read
• 10:37
  the BSB and account number to you over the phone.
• 10:40
  That one single slightly analog step can save
• 10:43
  you from losing everything. Okay, that's for
• 10:45
  the client. What about the business owner? Two
• 10:47
  big things. First, verify your vendors, the supply
• 10:50
  chain. You have to ask your software providers
• 10:53
  the hard questions. What are you doing for security?
• 10:55
  Because if they get hacked, you get hacked. And
• 10:57
  then the second thing. The boring basics. That
• 10:59
  ICAD breach. Five months of access from an unpatched
• 11:03
  VPN. That is an unforced error. It is leaving
• 11:06
  the front door wide open. Patch your systems.
• 11:08
  And backups are still a thing, right? They are
• 11:10
  critical. But not just having them. Testing them.
• 11:14
  And making sure they are immutable. Immutable,
• 11:17
  meaning they can't be changed. Exactly. The ransomware
• 11:19
  is programmed to find and encrypt your backups
• 11:22
  first. An immutable backup is locked. It can't
• 11:24
  be deleted or changed, even by an administrator,
• 11:26
  for a set period. It's your last line of defense.
• 11:29
  It really feels like we're moving past that old
• 11:31
  mantra of trust but verify. Trust but verify
• 11:34
  is dead. The modern philosophy is zero trust.
• 11:38
  Zero trust sounds a bit intense. It means what
• 11:41
  it says. Assume the breach has already happened.
• 11:44
  Assume every user, every device, every connection
• 11:47
  is hostile until proven otherwise. Verify everything,
• 11:50
  every time. That sounds exhausting. It adds a
• 11:53
  little friction, yes. But you have to weigh that
• 11:56
  friction against the alternative, which is posting
• 11:58
  on Facebook, because your entire business has
• 12:00
  been stolen. When you put it that way. A little
• 12:02
  friction sounds like a bargain. It's just the
• 12:04
  cost of doing business securely in 2026. You
• 12:07
  know, that 447 gigabyte number from Kelly Legal.
• 12:10
  It's just it's not just data, is it? It's lives.
• 12:13
  It's secrets. That's the core of it. We say data
• 12:17
  breach and it sounds so sterile. But it's human
• 12:20
  misery being packaged up and sold. These groups
• 12:23
  have turned professional confidentiality into
• 12:26
  a commodity. And they're very, very good at their
• 12:28
  business. Which means we have to be better at
• 12:30
  ours. We can't wait for the blackout. No. You
• 12:34
  have to ask yourself now, if INC Ransom knocked
• 12:37
  on my door tomorrow, what would they find? That
• 12:39
  is the question everyone needs to be thinking
• 12:41
  about. And look, if this conversation has made
• 12:43
  you a little uneasy, and it should, and you're
• 12:46
  sitting there wondering if your VPN is patched
• 12:48
  or if your members are secure, you really shouldn't
• 12:50
  try to solve this on your own. Absolutely not.
• 12:52
  This is a full -time job for experts. It is.
• 12:55
  So for anyone wanting to get ahead of this before
• 12:57
  you end up as a case study, I would really suggest
• 13:00
  you head over to www .kinsoft .com .au. Go and
• 13:03
  have a conversation with them about your security
• 13:05
  and your IT needs. It's a conversation you want
• 13:07
  to have on your own terms. Exactly. Better to
• 13:10
  have it now than with a hacker later. Well, that
• 13:13
  is all we have time for. A huge thank you for
• 13:16
  walking us through this terrifying new landscape.
• 13:19
  My pleasure. Stay safe. And thank you for listening
• 13:22
  to Tech Talks with Kinsoft. Until next time,
• 13:24
  update your systems, verify those bank details,
• 13:26
  and don't click the link. Goodbye.