Latest / Tech Talks With Kinsoft / Ransomware Attack on United Australia Party and Trumpet of Patriots

Transcript

Ransomware Attack on United Australia Party and Trumpet of Patriots · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. We're your
• 0:01
  guide for, well, cutting through the tech noise
• 0:04
  and getting to the insights that really matter.
• 0:06
  That's right. Making sense of the complex stuff.
• 0:08
  And today we're looking at something that, frankly,
• 0:11
  impacts all of us, cybersecurity, especially
• 0:13
  right here in Australia. There's been a real
• 0:15
  uptick in incidents lately. A worrying trend,
• 0:19
  definitely. Yeah. And one particular case involving
• 0:21
  a political party really highlights some unique
• 0:24
  risks. So today we'll unpack what went down.
• 0:28
  why it's, well, significant for you, and what
• 0:30
  it tells us about staying safe online. OK, let's
• 0:34
  dive into that specific incident first. The ransomware
• 0:37
  attack on Clive Palmer's Trumpet of Patriots
• 0:39
  and the United Australia Party, UAP. Yeah. This
• 0:42
  wasn't just, you know, another corporate hack.
• 0:45
  No, definitely not. The attack itself happened
• 0:47
  back on June 23rd, 2025, but it wasn't actually
• 0:51
  announced until mid -July, July 17th. OK, quite
• 0:54
  a delay there. Yes. And what happened was attackers
• 0:57
  got into their servers and, crucially, copied
• 0:59
  a lot of data. The potential scope here is, well,
• 1:02
  it's pretty vast. What kind of data are we talking
• 1:04
  about? It's a wide range and much of it deeply
• 1:06
  personal. Think banking records, emails, phone
• 1:09
  numbers, ID documents, employment history. Basically,
• 1:15
  all emails and documents they held on that server,
• 1:18
  everything. Wow. And here's a really concerning
• 1:21
  part. The parties themselves admitted they didn't
• 1:24
  comprehensively know what information was actually
• 1:26
  on the server. They didn't know what data they
• 1:27
  had. Apparently not comprehensively. And because
• 1:29
  of that, they said it was impracticable to notify
• 1:32
  individuals directly. Impracticable. Yeah. Instead
• 1:35
  of telling people their data might be out there.
• 1:37
  Exactly. They just posted a notice on their website.
• 1:40
  Now, they did take steps. They secured systems,
• 1:42
  restored from backups, reported it to the OAIC,
• 1:45
  that's the information commissioner, and the
• 1:47
  ASD, the signals directorate. Right, the standard
• 1:50
  incident response steps. Mostly, yes. And they
• 1:52
  gave the usual advice, monitor bank accounts,
• 1:55
  change passwords, use MFA, watch out for scams.
• 1:57
  But that lack of direct notification, that really
• 2:00
  stood out. Especially given whose data it was.
• 2:03
  Yeah. That notification piece or lack of it really
• 2:07
  hits differently with a political party, doesn't
• 2:09
  it? It feels bigger than just a company losing
• 2:12
  customer details. Absolutely. It's not just about
• 2:14
  financial risk, though, that's there. It's about,
• 2:17
  well. political affiliations, personal beliefs,
• 2:20
  maybe even private messages about democratic
• 2:22
  activities. That kind of information getting
• 2:25
  out, it's potentially weaponizable. Weaponizable.
• 2:28
  Yeah. That's a chilling thought. It strikes at
• 2:30
  the heart of privacy and, you know, even democratic
• 2:33
  processes. Precisely. And this whole situation
• 2:35
  throws a spotlight on a really significant loophole
• 2:39
  in Australian law. Which is? The Australian Privacy
• 2:42
  Act. It has this specific exemption just for
• 2:45
  political parties. An exemption. Meaning unlike
• 2:48
  almost every other organization handling your
• 2:50
  data, political parties aren't legally required
• 2:53
  to report data breaches under the notifiable
• 2:55
  data breaches scheme. They also don't have to
• 2:57
  follow many of the basic rules about handling
• 2:59
  personal information. So the UAP telling anyone
• 3:02
  about this breach was entirely voluntary. Entirely
• 3:06
  voluntary. They had no legal obligation under
• 3:08
  the Privacy Act to do so. That seems odd. Hasn't
• 3:11
  this been raised before? Oh, yes. For years.
• 3:14
  The Attorney General's Department did a big review
• 3:16
  of the Privacy Act report back in 2022. They
• 3:19
  explicitly called this exemption a significant
• 3:22
  risk. A significant risk. So the government knew.
• 3:25
  They were certainly told. The report noted that
• 3:27
  almost all submissions they got argued the exemption
• 3:30
  couldn't be justified. They said there was basically
• 3:33
  no clear reason why parties should not be accountable
• 3:37
  like everyone else. So if the parties holding
• 3:40
  data about our political views, our voting intentions
• 3:43
  are exempt. from rules everyone else follows.
• 3:46
  What does that mean for us, for the average person?
• 3:49
  It means they have privileged access to the electoral
• 3:52
  roll and they can build these huge databases
• 3:55
  on voters, demographics, beliefs, you name it.
• 3:57
  Reset Australia warned this stuff is very valuable
• 4:00
  and potentially dangerous. Dangerous how? Like
• 4:04
  for election interference. That's exactly the
• 4:06
  fear. Malicious actors could exploit this weak
• 4:08
  spot to mess with democratic processes. Imagine
• 4:11
  targeted disinformation campaigns based on stolen
• 4:13
  political profiles. Even the privacy commissioner,
• 4:16
  Carly Kind, she publicly questioned if the exemption
• 4:20
  is still appropriate. She said it's out of step
• 4:23
  with community expectations and the risks we
• 4:25
  face now, you know, in the digital age. It sounds
• 4:28
  like there's a strong consensus this needs fixing.
• 4:30
  What has the government actually done? Well,
• 4:33
  the current government, when they responded to
• 4:35
  that big privacy review, they mostly just noted.
• 4:38
  the recommendations about the political party
• 4:40
  exemption just noted yep and the first set of
• 4:44
  privacy law changes they brought in didn't touch
• 4:46
  the exemption so despite the warnings the loophole
• 4:49
  remains it does and that brings us back to the
• 4:51
  uap's response the lack of care critique saying
• 4:54
  it was impracticable to notify people i mean
• 4:57
  that's just basic cyber security practice 101
• 4:59
  especially with sensitive data it really highlights
• 5:02
  gap okay so the uap incident is a stark example
• 5:06
  But was July just a bad month for them? Or was
• 5:08
  it indicative of wider issues across Australia?
• 5:11
  What else was going on? Oh, July was definitely
• 5:14
  busy. It wasn't just politics. Look at Qantas,
• 5:16
  a huge incident affecting, what, six million
• 5:19
  frequent flyer members? Six million? How did
• 5:23
  that happen? Interestingly, it wasn't a direct
• 5:26
  hack on Qantas systems. It was fishing over the
• 5:30
  phone at a third -party call center they use
• 5:33
  in the Philippines. Ah, the supply chain risk.
• 5:35
  Exactly. Social engineering. They got names,
• 5:37
  emails, phone numbers, birthdates, frequent flyer
• 5:40
  numbers. Groups like Scattered Spider are known
• 5:43
  for this kind of sophisticated social engineering
• 5:45
  against call centers. They've hit big names globally.
• 5:48
  Right. So third parties are a major vulnerability.
• 5:50
  What else? We saw Metricon Homes, the big builder,
• 5:53
  get hit by ransomware. The Quine Group claimed
• 5:56
  responsibility. Ransomware again. What did they
• 5:59
  lose? About 128 gigs of data, financial records,
• 6:03
  employee details, even sensitive architectural
• 6:05
  plans. That's intellectual property theft right
• 6:08
  there, plus massive disruption. Ouch. And then
• 6:11
  there was a Northern Territory government agency.
• 6:13
  They got caught by a business email compromise
• 6:16
  scam, a BEC attack. The fake invoice scams. Pretty
• 6:20
  much. Someone was tricked into transferring over
• 6:22
  $3 .5 million to a fraudulent account. $3 .5
• 6:25
  million. Did they get it back? Most of it, thankfully.
• 6:28
  But it shows how effective and costly these BEC
• 6:31
  scams can be. Still a massive breach of process.
• 6:34
  So politics, airlines, construction, government.
• 6:38
  It's hitting everywhere. Absolutely. And that's
• 6:40
  not all for July. Louis Vuitton had Australian
• 6:42
  customer data exposed. Ingram microfaced ransomware.
• 6:46
  There was an accidental breach at the Migration
• 6:48
  Agents Authority. Even an Adelaide women's health
• 6:51
  clinic had sensitive patient data stolen. It
• 6:53
  was relentless. It shows the sheer scale and
• 6:55
  variety. Yeah. Any stats on ransomware specifically?
• 6:58
  Seems to keep cropping up. Yeah. The ASD, the
• 7:00
  Signals Directorate, they responded to 121 ransomware
• 7:04
  incidents in the last financial year, 23 -24.
• 7:07
  That was 11 % of all. the incidents they handled.
• 7:09
  11%. And the OAIC, the privacy watchdog, reported
• 7:12
  that ransomware was involved in 26%, so over
• 7:15
  a quarter of all cyber incidents that actually
• 7:18
  resulted in a notifiable beta breach during that
• 7:20
  same period. It's a huge part of the problem.
• 7:22
  And these threats, they aren't just local, are
• 7:25
  they? What was happening internationally in July
• 7:27
  that reflects this bigger picture? Right. It's
• 7:29
  definitely a global issue. We saw, for example,
• 7:32
  some very sophisticated state -sponsored activity.
• 7:36
  Groups linked to China called Linen Typhoon and
• 7:38
  Violet Typhoon were exploiting brand new flaws
• 7:41
  zero days in Microsoft SharePoint. Zero days.
• 7:44
  So flaws nobody knew about. Exactly. They hit
• 7:47
  over 50 organizations worldwide, including governments.
• 7:50
  Shows that high -level espionage and disruption
• 7:53
  campaigns are constantly ongoing. That's the
• 7:55
  high -tech end. Anything simpler. Oh, absolutely.
• 7:58
  You won't believe this one. McDonald's. AI hiring
• 8:01
  site got breached, exposed 64 million records.
• 8:05
  64 million. How sophisticated AI attack. Nope.
• 8:08
  The admin password was 123456. You're kidding.
• 8:12
  Wish I was. Just goes to show you can have all
• 8:15
  the fancy tech in the world, but if you miss
• 8:17
  the absolute basics, like a strong password.
• 8:20
  Well, you're wide open. It's almost comical if
• 8:22
  it weren't so serious. Basic cyber hygiene. It
• 8:24
  always comes back to that, doesn't it? Yeah.
• 8:26
  OK, so connecting all this local incidents, global
• 8:28
  trends, simple mistakes, state actors. How are
• 8:31
  governments and regulators trying to respond?
• 8:34
  What's changing on the policy front? Well, we're
• 8:36
  seeing different approaches globally. The UK,
• 8:39
  for instance, is proposing a ban on ransomware
• 8:42
  payments, at least for the public sector and
• 8:44
  critical infrastructure. A complete ban. Trying
• 8:47
  to cut off the money supply. That's the idea.
• 8:50
  Australia has gone a different way, though. We
• 8:51
  have mandatory reporting of ransomware payments
• 8:54
  within 72 hours, but no actual ban. Why not ban
• 8:57
  them here? The main argument is about operational
• 9:00
  risk. The concern is that banning payments might
• 9:03
  stop a hospital or a key utility from getting
• 9:06
  back online quickly, potentially causing even
• 9:09
  more harm. It's a tricky balance. I see. So reporting,
• 9:13
  but no ban. What about holding companies accountable
• 9:16
  before they pay or even before they get hit?
• 9:19
  That's definitely heating up. ASIC, the corporate
• 9:21
  regulator here, is getting much more active.
• 9:23
  They've recently filed charges against Fortnum
• 9:25
  Private Wealth, alleging they failed to manage
• 9:27
  cybersecurity risks properly. Charges. That sounds
• 9:30
  serious. It is. And it's not the first time.
• 9:33
  It's actually ASIC's third cyber -related court
• 9:35
  action after cases against RI Advice and FIRG
• 9:39
  Group. The message is clear. Regulators expect
• 9:42
  companies to take cybersecurity seriously, and
• 9:45
  there are consequences if they don't show due
• 9:47
  diligence. It's about accountability. OK, so
• 9:49
  regulators are stepping up. The threats are constant.
• 9:52
  This really brings it home for everyone listening.
• 9:55
  Given everything we've discussed, what are the
• 9:57
  key lessons? What practical things can people
• 9:59
  and businesses actually do? Right. Let's get
• 10:02
  practical. Based on these incidents, especially
• 10:04
  Qantas, number one has to be review your third
• 10:07
  party cyber risk. Seriously, scrutinize your
• 10:10
  suppliers, partners, anyone who touches your
• 10:12
  data or systems, especially call centers. Don't
• 10:15
  just trust. Verify. Absolutely. Train their staff,
• 10:18
  too, if possible, on social engineering. Demand
• 10:21
  strong identity checks. Your security is only
• 10:24
  as strong as your weakest link, and often that
• 10:26
  link is external. Okay. Third -party risk. What
• 10:29
  else? Second, threat hunting and patching. Don't
• 10:32
  just wait for alarms. Actively look for signs
• 10:34
  of trouble in your systems. And patch, patch,
• 10:37
  patch, especially known exploited vulnerabilities
• 10:40
  like those SharePoint ones. Patching quickly
• 10:42
  is critical. Don't leave the door open. Be proactive,
• 10:45
  not just reactive. And the third. Third, really
• 10:48
  double down on combating business email compromise,
• 10:52
  BEC. That NT government scam is a perfect, painful
• 10:56
  reminder. Training is key. Help your staff spot
• 10:59
  those fake, urgent emails. But critically, turn
• 11:03
  on multi -factor authentication MFA. That extra
• 11:06
  code, that app approval, make it mandatory, especially
• 11:09
  for financial transactions or sensitive access.
• 11:11
  MFA everywhere. Everywhere possible. And one
• 11:13
  more thing for BEC. Check your domain name renewals.
• 11:16
  Make sure they're set to auto -renew. Attackers
• 11:18
  sometimes hijack expired domains to send convincing
• 11:21
  fake emails. It's a simple thing, but it closes
• 11:23
  another door. Right. Review third parties, hunt
• 11:26
  threats and patch fasts, and fight BEC with training,
• 11:29
  MFA, and domain checks. Seems like solid advice.
• 11:32
  They're foundational steps, really. Covering
• 11:34
  the basics goes a long, long way. It really makes
• 11:36
  you think, though. In this era where everything's
• 11:39
  connected, even our political views seem up for
• 11:41
  grabs. How much of our data are we just handing
• 11:43
  over? Without a second thought. And who should
• 11:46
  really be responsible for protecting it? What
• 11:49
  level of care do we expect? That's the fundamental
• 11:51
  question we all need to grapple with, isn't it?
• 11:53
  What does true digital stewardship look like
• 11:56
  in the 21st century? Definitely something to
• 11:59
  mull over. Well, that's all the time we have
• 12:01
  for this discussion on Tech Talks with Ken Soft.
• 12:03
  Thanks so much for tuning in. Yeah, thanks for
• 12:05
  listening. Remember, staying informed and proactive
• 12:08
  is genuinely your best defense in cybersecurity.
• 12:11
  It's vital for everyone. Absolutely. And if these
• 12:13
  issues have you thinking about your own security
• 12:15
  or IT setup, feel free to reach out. You can
• 12:18
  visit us at www .kinsoft .com .au to discuss
• 12:22
  your needs.