Latest / Tech Talks With Kinsoft / How many VETtrak customers were affected by the October cyberattack?

Transcript

How many VETtrak customers were affected by the October cyberattack? · Tech Talks With Kinsoft

• 0:00
  Hello and welcome to Tech Talks with Kinsoft.
• 0:02
  It's great to have you with us. Great to be here.
• 0:04
  Today we're going to strip back the headlines
• 0:06
  a bit and look at the operational reality of
• 0:09
  running a business in a digital world. We spend
• 0:12
  so much time talking about tech as this magical
• 0:14
  enabler. The thing that speeds you up connects
• 0:17
  you to everyone. Exactly. But today we need to
• 0:21
  look at the flip side. What happens when the
• 0:23
  tech just stops you dead in your tracks? It's
• 0:26
  the side of the coin we all hope to avoid, but...
• 0:29
  Statistically, it's the one we're most likely
• 0:31
  to encounter at some point. We aren't talking
• 0:33
  shiny new gadgets today. We're looking at that
• 0:36
  that stomach dropping moment when the screen
• 0:39
  goes dark, the data vanishes and suddenly the
• 0:41
  clock is ticking on your legal obligations. Precisely.
• 0:45
  And usually when we talk about cyber incidents,
• 0:47
  it's always the big one. Right. You know, state
• 0:49
  sponsored actors, global banks. It feels like
• 0:52
  a movie. A bit abstract. Yeah, a bit abstract.
• 0:54
  So I wanted to shift the lens today. We've got
• 0:57
  a stack of sources here about a really significant
• 0:59
  incident from late 2025 involving a company called
• 1:03
  ReadyTech and their platform V -Track. And this
• 1:06
  is such a crucial case study because V -Track,
• 1:08
  I mean, it's not some abstract cloud thing. It
• 1:10
  is the engine room for a massive chunk of Australia's
• 1:13
  vocational education and training sector. Right.
• 1:16
  If you've done a TAFI course, a certificate,
• 1:18
  any kind of trade up skilling in Australia. there
• 1:22
  is a very, very high chance your data has passed
• 1:25
  through this system. So our mission today is
• 1:28
  to use this specific incident, the VT track breach,
• 1:30
  as a kind of a live autopsy. We're going to break
• 1:34
  down the timeline of a supply chain attack to
• 1:36
  see how it actually unfolds day by day. But then,
• 1:39
  and this is the important part, we need to answer
• 1:40
  the so what question. We're going to pivot to
• 1:42
  the Australian regulatory landscape, specifically
• 1:44
  the Notifiable Data Breaches Scheme, or NDB.
• 1:47
  Because when things go wrong, The law has a very
• 1:51
  specific script you have to follow. There's not
• 1:53
  a free -for -all. Not at all. There is a playbook,
• 1:55
  and if you don't follow that script, the consequences,
• 1:58
  legal, financial, reputational, can actually
• 2:01
  be worse than the hack itself. Okay, so let's
• 2:04
  start with the anatomy of the breach itself.
• 2:06
  I was reading through the timeline, and what
• 2:08
  really struck me was that fog -of -war phase
• 2:11
  at the beginning. We think a hack is instant,
• 2:14
  you know, skull and crossbones on the screen.
• 2:16
  But it's almost never like that. This began on
• 2:19
  October 16th, 2025. VT -Track customers experienced
• 2:23
  what was just labeled an outage. An outage. And
• 2:27
  for anyone in IT, outage is such a loaded word.
• 2:30
  It covers a multitude of sins. It could be a
• 2:32
  failed router, or it could mean someone is, you
• 2:35
  know, actively encrypting your entire database.
• 2:37
  And that ambiguity, it lasted for a painfully
• 2:40
  long time. It wasn't until November 3rd, that's
• 2:42
  over two weeks later, that ReadyTech confirmed
• 2:44
  it was a cyber attack. That gap must have been
• 2:46
  just excruciating for their customers, the training
• 2:49
  colleges, the organizations. They're flying blind.
• 2:51
  Totally flying blind. You can't tell your students
• 2:54
  what's happening because you don't even know.
• 2:56
  But while everyone was waiting in that limbo,
• 2:59
  things were escalating behind the scenes. The
• 3:02
  sources say that on October 31st, Halloween,
• 3:05
  at 9 p .m. AEDT, the threat actors stopped playing
• 3:09
  games. That's the escalation point. They published
• 3:12
  13 ,866 files on the dark web. And that's the
• 3:16
  pivot. Right. We move from a business continuity
• 3:20
  problem software not working to a full -blown
• 3:23
  privacy crisis. Precisely. And we need to look
• 3:26
  at the collateral damage here. ReadyTech identified
• 3:28
  that 23 specific customers were caught up in
• 3:31
  that data dump. Now, seeing that number, 23,
• 3:34
  my first reaction was, only 23? That seems low.
• 3:37
  We're so used to hearing about millions of accounts.
• 3:39
  It does sound low, yeah, especially compared
• 3:41
  to the massive user base of VT -TRAC. They estimated
• 3:44
  fewer than 3 ,000 individuals were affected.
• 3:46
  But, and this is so important, in data breaches,
• 3:49
  we have to stop looking at the volume and start
• 3:50
  looking at the value. The toxicity of the data.
• 3:52
  The toxicity, the sensitivity. You have to look
• 3:54
  at what was actually lost. And one of the victims
• 3:57
  profiled in the reports really brings this home.
• 4:01
  Vecho. The Victorian Aboriginal Community Controlled
• 4:04
  Health Organization. This isn't just a marketing
• 4:07
  list of email addresses we're talking about.
• 4:09
  It's student records for Aboriginal health workers.
• 4:12
  That changes the entire calculation. The sources
• 4:15
  list Medicare numbers, identity documents, driver's
• 4:19
  licenses. That's the holy trinity for identity
• 4:21
  theft. It really is. If you lose that data, you're
• 4:24
  not just changing a password. You are monitoring
• 4:26
  your credit report for the next five years. And
• 4:28
  think about the trust dynamic there. organization.
• 4:32
  Their students trust them with their entire lives,
• 4:35
  their careers. The impact of having to tell those
• 4:38
  students, we lost your ID, is just, it's devastating.
• 4:41
  It's a huge breach of trust. They had to advise
• 4:44
  students to contact ID Care, which is the National
• 4:46
  Support Service for Identity Theft, and verify
• 4:49
  all their identity documents. It just disrupts
• 4:51
  that foundational trust. It really does. Now,
• 4:54
  there's a fascinating legal maneuver in this
• 4:56
  timeline that I think is worth unpacking. On
• 4:59
  October 29th, ReadyTech went to the NSW Supreme
• 5:02
  Court and got an injunction. Right. Basically
• 5:04
  a court order. Yeah. A court order prohibiting
• 5:07
  access to or dissemination of the stolen data.
• 5:10
  Yeah. Now, I have to play devil's advocate here.
• 5:13
  We're talking about the dark web. It's run by
• 5:15
  international criminal syndicates who, by definition,
• 5:19
  do not care about the Supreme Court of New South
• 5:21
  Wales. So is an injunction just an expensive
• 5:23
  piece of paper? Does it actually do anything?
• 5:26
  It's a valid skepticism. And technically, you're
• 5:29
  right. The hackers aren't going to take the files
• 5:30
  down because a judge said so. They're beyond
• 5:32
  the jurisdiction. So what's the point? Strategically,
• 5:35
  it's actually a very smart move for containing
• 5:38
  the damage on the surface web. Ah, so it targets
• 5:41
  the onlookers. Yeah. The people who might share
• 5:43
  it on Twitter or Reddit. Exactly. It makes it
• 5:46
  illegal for journalists, for curious onlookers
• 5:49
  or other bad actors to download or share that
• 5:52
  data. It puts a big do not enter sign around
• 5:55
  the toxic spill. It doesn't clean it up, but
• 5:58
  it stops the average person from walking through
• 6:00
  it and spreading it further. That's a helpful
• 6:02
  distinction. It limits the blast radius. Now,
• 6:05
  before we terrify everyone listening who uses
• 6:07
  cloud software, there is an important nuance
• 6:09
  here regarding a group called Signature Training
• 6:12
  College. Right. also VT track users. But they
• 6:16
  came out with a very clear statement confirming
• 6:18
  they were not among the 23 affected customers.
• 6:21
  Which highlights a key part of modern cloud architecture
• 6:24
  that business owners really need to get their
• 6:26
  heads around. It's rarely one giant bucket. Right.
• 6:29
  Just because the platform takes a hit doesn't
• 6:31
  mean every single tenant, every customer is compromised.
• 6:34
  It depends on which server your instance was
• 6:36
  on, which database was accessed. It shows the
• 6:39
  importance of compartmentalization. But for the
• 6:41
  23 who were hit. the reality shifted immediately
• 6:44
  from tech problem to legal problem. And that
• 6:48
  brings us to the core of our discussion today,
• 6:50
  the so what moment. When an organization like
• 6:53
  Vatchogo realizes their data is out there, they
• 6:56
  can't just fix the firewall and hope nobody notices.
• 7:00
  No, we operate under a very strict regime here
• 7:03
  in Australia. The Notifiable Data Breaches Scheme,
• 7:05
  or NDB, it's part of the Privacy Act, 1988, and
• 7:09
  when it came in, it fundamentally changed the
• 7:11
  game. Before the NDB, companies could, and look,
• 7:15
  they often did, sweep things under the rug. To
• 7:18
  save face. To save face. Now, that silence is
• 7:21
  illegal. But I think there's still confusion
• 7:23
  about the threshold. I mean, if I leave a USB
• 7:26
  stick with some marketing brochures on the bus,
• 7:28
  surely I don't have to report that to the government.
• 7:30
  That seems excessive. You're right, there is
• 7:33
  a threshold. It's not just any data loss. According
• 7:35
  to the guidance we have from Invotech, there
• 7:37
  are three specific triggers that must all be
• 7:39
  met to force a notification. Okay, walk us through
• 7:41
  them. What's trigger number one? First, there
• 7:43
  has to be unauthorized access, disclosure, or
• 7:46
  loss of personal information. That's the event
• 7:48
  itself. The hack, the lost laptop, the email
• 7:51
  sent to the wrong person. Okay, standard. Trigger
• 7:54
  two. Second, and this is the subjective part
• 7:57
  that trips people up. A reasonable person would
• 8:00
  conclude that this is likely to result in serious
• 8:02
  harm to the individuals involved. OK, I want
• 8:05
  to pin down serious harm because I feel like
• 8:07
  a lot of executives hear that and just think
• 8:09
  financial loss. They think, well, no one's bank
• 8:12
  account was drained, so it's not serious. That
• 8:14
  is a very dangerous misconception. The definition
• 8:17
  of serious harm in the Privacy Act is much, much
• 8:21
  broader than your bank balance. Yes, it includes
• 8:23
  financial fraud, of course, but it also includes
• 8:26
  things like physical harm. A stalker getting
• 8:29
  a home address. Exactly. It includes reputational
• 8:32
  damage. That's a huge one. If a medical status
• 8:35
  or workplace dispute record gets leaked, that
• 8:37
  could ruin a career. Absolutely. And it also
• 8:40
  includes emotional distress. If a breach causes
• 8:43
  significant anxiety, which having your Medicare
• 8:45
  number stolen definitely does, that counts as
• 8:47
  serious harm. So the bar for harm is actually
• 8:49
  quite low. Okay, and the third trigger? The third
• 8:52
  is the get -out -of -jail -free card, in a way.
• 8:55
  Notification is only required if the entity has
• 8:58
  been unable to prevent the likely risk of serious
• 9:00
  harm through remedial action. So, going back
• 9:03
  to my USB stick example, if I realize I lost
• 9:06
  it... But I use a remote management tool to wipe
• 9:09
  it before anyone can plug it in. Then you have
• 9:11
  prevented the risk of harm. The data is gone,
• 9:14
  but the risk is neutralized. No harm, no notification.
• 9:18
  That's why having remote wipe capabilities isn't
• 9:20
  just a tech feature. It's a compliance shield.
• 9:22
  That makes perfect sense. Now, who are we talking
• 9:25
  about here? Is this just for the big banks and
• 9:27
  telcos? The general rule is any business with
• 9:30
  an annual turnover of more than $3 million. So
• 9:33
  your local cafe is probably exempt? But wait,
• 9:36
  Vichichow is a nonprofit and a lot of training
• 9:38
  colleges aren't massive corporations. So why
• 9:41
  were they on the hook in this Vichachrek incident?
• 9:43
  Because there are critical exceptions. Regardless
• 9:46
  of your revenue, if you are a health care provider
• 9:48
  or an educational institution, you must comply.
• 9:51
  So if you hold the data, you hold the liability.
• 9:54
  Correct. The government decides that health and
• 9:56
  student records are just too sensitive to be
• 9:58
  unregulated. It also applies to anyone handling
• 10:02
  tax file numbers. So basically... If you employ
• 10:05
  staff in Australia, you're almost certainly caught
• 10:08
  in this net. OK, so we've established the triggers.
• 10:11
  Now I want to put our listener in the hot seat.
• 10:13
  Imagine it's Tuesday morning. You get an email
• 10:16
  from your IT manager or maybe a ransom note just
• 10:18
  pops up on your screen. You've been breached.
• 10:21
  Panic sets in. What do you actually do? The first
• 10:24
  thing to do is suppress the urge to just scream.
• 10:27
  You need to follow the four -step process from
• 10:29
  the scheme. And step one is purely operational.
• 10:32
  Contain the breach. Stop the bleeding. Immediately.
• 10:35
  This isn't about finding out who did it yet.
• 10:36
  That comes later. This is about shutting down
• 10:38
  compromised accounts, disconnecting infected
• 10:40
  servers, changing master passwords. You have
• 10:43
  to make sure the data loss stops now. Okay. The
• 10:45
  bleeding is stopped. The server is offline. What's
• 10:48
  step two? Assessment. And this is where the clock
• 10:51
  starts ticking. You have a strict 30 -day window
• 10:53
  to investigate. You need to review logs, interview
• 10:56
  staff, maybe bring in forensic experts. You are
• 10:59
  trying to answer one question. Is serious harm
• 11:02
  likely? 30 days sounds like a long time. But
• 11:06
  I imagine in a crisis with lawyers and PR teams
• 11:09
  all involved, that time, just... It evaporates.
• 11:14
  It vanishes. Especially if your logs are messy
• 11:17
  or non -existent. If you can't prove what wasn't
• 11:19
  taken, you often have to assume the worst. So
• 11:21
  let's say the assessment comes back bad. Harm
• 11:23
  is likely. Step three. Notification. You have
• 11:27
  to notify the individuals who are affected. And
• 11:29
  this is crucial. The guidelines are very specific
• 11:31
  and must be in plain English. So no hiding behind
• 11:33
  legal jargon. No unforeseen anomaly in the subnet.
• 11:37
  No. You have to be transparent. Tell them what
• 11:39
  information was compromised and, most importantly,
• 11:42
  what steps they should take to protect themselves.
• 11:44
  Look at Vic Cho again. They didn't just say,
• 11:45
  oops. They gave actionable advice. Contact ID
• 11:49
  care. Watch for these scams. It empowers the
• 11:51
  victim, which is the whole point. And finally,
• 11:53
  step four. You have to tell the regulator. You
• 11:56
  submit a form to the OAIC, the Office of the
• 11:59
  Australian Information Commissioner. and your
• 12:01
  story to them has to match your story to your
• 12:04
  customers. Now, I have to ask the cynical question
• 12:06
  that I'm sure some business owners are thinking.
• 12:08
  What if I just don't? What if I roll the dice,
• 12:10
  hide it, and hope it never comes out? That is
• 12:14
  a high -stakes gamble with very, very poor odds.
• 12:18
  If you're caught covering up, the OAIC has teeth.
• 12:21
  They can issue public reprimands, which are humiliating.
• 12:25
  They can issue compensation orders and they can
• 12:28
  pursue civil penalties of up to two point five
• 12:30
  million dollars. Two and a half million dollars.
• 12:32
  That's a serious hit to the bottom line for almost
• 12:35
  any business. It is. But honestly, most experts
• 12:38
  agree the fine is the lesser evil. The real cost
• 12:40
  is your reputation. Your trust deficit. Exactly.
• 12:43
  Customers, they understand that cybercrime happens.
• 12:46
  It's a fact of life in 2026. They might forgive
• 12:48
  you for getting hacked. They will very rarely
• 12:51
  forgive you for lying about it. Right. If you
• 12:53
  hide it and it leaks later and on the dark web,
• 12:55
  things always leak eventually. Your credibility
• 12:58
  is just destroyed. Transparency beats cover -ups
• 13:01
  every time. OK, so we've covered the horror story
• 13:05
  of the breach and we've covered the legal rulebook.
• 13:07
  Let's talk about how to stop this from becoming
• 13:09
  our reality. Let's talk prevention. Prevention
• 13:12
  is always, always cheaper than remediation. The
• 13:16
  InvoTech guide breaks this down into two main
• 13:18
  pillars, the human factor and the tech essentials.
• 13:22
  Let's start with the humans, because as much
• 13:24
  as we love technology, we are usually the problem,
• 13:27
  aren't we? Unfortunately, yes. Look, sophisticated
• 13:29
  code is dangerous, but simple human error is
• 13:33
  often the open door. Someone reusing their Netflix
• 13:36
  password on their work email. Someone clicking
• 13:38
  a phishing link because they were in a rush.
• 13:40
  So what's the fix? Is it just telling people
• 13:42
  don't do that? It's continuous training. It can't
• 13:45
  be a boring video once a year that everyone just
• 13:48
  skips through. It has to be regular. Yeah. Phishing
• 13:50
  simulations, password hygiene checks. You have
• 13:53
  to build a security culture where staff aren't
• 13:55
  afraid to report a mistake. That's a great point.
• 13:57
  If someone clicks a link, you want them to call
• 13:59
  IT immediately, not hide it because they're afraid
• 14:02
  of getting in trouble. Make it. safe to fail
• 14:04
  so you can fix it fast. And on the tech side,
• 14:08
  I feel like we shout this from the rooftops every
• 14:10
  week, but let's say it again for the people in
• 14:12
  the back. Multi -factor authentication, MFA.
• 14:16
  You do not have MFA turned on for your critical
• 14:19
  systems. You are, frankly, being negligent at
• 14:22
  this point. It stops the vast majority of these
• 14:25
  attacks. It's the seatbelt of the internet. Just
• 14:27
  click it, takes two seconds. Exactly. Beyond
• 14:30
  that, it's the unglamorous stuff. Patching your
• 14:32
  software. Those annoying update tonight prompts.
• 14:35
  They often contain critical security fixes. If
• 14:38
  you delay the update, you're leaving the door
• 14:40
  wide open for hackers. There's one more recommendation
• 14:43
  in here that I think is the most overlooked but
• 14:45
  possibly the most valuable. The incident response
• 14:47
  plan. This is the difference between a crisis
• 14:50
  and a disaster. You do not want to be making
• 14:52
  decisions when your hair is on fire. You need
• 14:55
  a document written now that outlines exactly
• 14:57
  who does what. Like a fire drill for data. Precisely.
• 15:01
  Who calls the lawyers? Who has the authority
• 15:03
  to shut down the e -commerce store? Who drafts
• 15:05
  the press release? You need these roles defined,
• 15:08
  and you need to test it. Do a tabletop exercise
• 15:10
  once a year. Sit around a table and simulate
• 15:13
  a VT track style breach. Okay, the server's down.
• 15:15
  What do we do? See if your team actually knows.
• 15:17
  That is such solid advice. Because when the panic
• 15:20
  hits, your IQ drops about 20 points. You want
• 15:24
  to be following a checklist, not improvising.
• 15:26
  Precisely. Improvisation is great for jazz, terrible
• 15:28
  for cybersecurity. We have covered a massive
• 15:31
  amount of ground today. We started with the VDTRAKE
• 15:33
  incident, seeing how a silent outage morphed
• 15:36
  into a dark web data dump affecting vulnerable
• 15:38
  students. We saw how that triggered the legal
• 15:41
  machinery of the NDB scheme, forcing organizations
• 15:43
  like VACHO to notify and protect their people.
• 15:46
  We unpacked that 30 -day ticking clock contain,
• 15:49
  assess, notify, report, and we... emphasize that
• 15:53
  serious harm isn't just about bank accounts.
• 15:55
  It's about reputation and mental well -being.
• 15:59
  And finally, the pivot to prevention. Train your
• 16:01
  humans, update your tech, and please, for the
• 16:04
  love of God, have a plan written down. So I want
• 16:06
  to leave our listeners with a final thought.
• 16:08
  We've talked about that sinking feeling when
• 16:10
  you realize you've been breached, the oh -no
• 16:13
  moment. It's the moment you realize your business
• 16:15
  is no longer under your control. If that happened
• 16:18
  to you in the next hour, if you got that call
• 16:20
  right now, Would you know who to call? Would
• 16:23
  your team know which server to isolate? Or would
• 16:26
  you be sitting there Googling what to do during
• 16:29
  a data breach? That is the question that should
• 16:31
  keep directors awake at night. If the answer
• 16:33
  is, I'd be Googling it, you are already behind
• 16:36
  the curve. You certainly are. But look, if you're
• 16:39
  listening to this and thinking, I don't have
• 16:40
  a plan, or I'm not sure if my backup strategy
• 16:43
  is actually compliant, you really don't have
• 16:45
  to figure it out alone in the dark. No, that's
• 16:48
  what experts are for. Security is complex, but
• 16:51
  getting good advice is simple. That's why we
• 16:53
  strongly suggest you head over to www .kinsoft
• 16:57
  .com .au. Whether you need to audit your security
• 17:00
  setup, discuss your IT needs, or just want to
• 17:02
  make sure you're prepared for exactly these kinds
• 17:05
  of scenarios, they are the team to talk to. Absolutely.
• 17:08
  Don't wait for the breach to meet your IT partner.
• 17:11
  Go to www .kinsoft .com .au and get on the front
• 17:15
  foot. Thank you so much for joining us on this
• 17:17
  exploration of the VET track incident and the
• 17:20
  NDB landscape. It's been a heavy topic, but an
• 17:23
  essential one. Always a pleasure. Stay safe and
• 17:25
  keep those passwords strong. We'll catch you
• 17:27
  next time on Tech Talks with Kinsoft. Bye for
• 17:28
  now.