Latest / Tech Talks With Kinsoft / Victorian Department of Education – January 2026 data breach

Transcript

Victorian Department of Education – January 2026 data breach · Tech Talks With Kinsoft

• 0:00
  Hello and welcome back to Tech Talks with Ken
• 0:01
  Soft. I'm your host and I'm thrilled to be back
• 0:04
  behind the mic with you. As always, I'm joined
• 0:06
  by our resident expert to sift through the noise
• 0:08
  of the tech world. Great to be here. And today
• 0:11
  we are unpacking a scenario that is practically
• 0:14
  a masterclass in how not to structure a network.
• 0:17
  Yeah, we have a really fascinating deep dive
• 0:19
  for you all today. We are looking at the massive
• 0:21
  cyber incident that hit the Victorian Department
• 0:23
  of Education in January of 2026. Right. And we
• 0:28
  aren't just reading the headlines. Our mission
• 0:30
  today is to look at the why, the network architecture
• 0:33
  behind it, the real risks to students regarding
• 0:36
  identity theft, and, of course, the political
• 0:38
  fallout. Because it is a massive story. It really
• 0:41
  is. To set the stage, we need to wrap our heads
• 0:44
  around the scale. We are talking about unauthorized
• 0:46
  access potentially impacting 1 ,575 government
• 0:51
  schools. Over 665 ,000 students. That is current
• 0:55
  students and past students. It is a staggering
• 0:57
  human cost. It is. So let's get right into the
• 1:00
  facts. According to the official Victorian government
• 1:03
  release, an external third party breached a specific
• 1:07
  Department of Education database. Yes, and usually
• 1:09
  when we do a deep dive into breaches, we look
• 1:12
  for the crown jewels, right? The financial data,
• 1:16
  health records. But those weren't touched here.
• 1:18
  No, they explicitly stated that birth dates,
• 1:22
  home addresses, phone numbers, and family medical
• 1:24
  records were safe. Which I imagine made a lot
• 1:27
  of parents exhale. Oh, absolutely. But, and this
• 1:30
  is a big but, we need to look at what was actually
• 1:32
  compromised. Right. Student names, their school,
• 1:35
  year levels, school -issued email addresses,
• 1:38
  and encrypted passwords. So I have to ask you.
• 1:40
  But the home address is safe. Is this just bad
• 1:43
  or is this catastrophic? Well, I mean, the sheer
• 1:45
  volume makes it significant. The government emphasized
• 1:48
  the passwords were encrypted, which sounds safe
• 1:50
  to a layperson. It sounds like scrambled text.
• 1:53
  Exactly. But in our world, encrypted does not
• 1:56
  mean inaccessible. If a teenager used a weak
• 1:58
  password like, you know, school 2026, it is incredibly
• 2:02
  easy for hackers to crack the encrypted hash.
• 2:05
  Yeah, that doesn't take a supercomputer. Not
• 2:07
  at all. And the department knew this. Their immediate
• 2:10
  response was to deactivate passwords entirely
• 2:13
  and force schools to issue new ones at the start
• 2:16
  of the 2026 school year. Which is... I want you
• 2:20
  to imagine being an IT admin for those 1 ,500
• 2:24
  schools. A nightmare. Trying to recredential
• 2:27
  over half a million kids while the teacher is
• 2:29
  just trying to get through first period. Yes.
• 2:31
  But let's pivot to the structural issue here.
• 2:33
  Because the big question in my research was,
• 2:35
  how did they get everyone's data at once? That
• 2:38
  is the core technical failure. We pulled a great
• 2:42
  analysis from Security Brief Australia featuring
• 2:45
  Jason Pierce from Clarity. Oh, I love the analogy
• 2:48
  he used. Right. He said a single loose brick
• 2:50
  brought down the entire wall. A single loose
• 2:53
  brick. Yes. Because they were running what we
• 2:56
  call a flat network. Explain that for the listener
• 2:58
  who might be, say, running their own business
• 3:00
  network right now. What is a flat network? Imagine
• 3:03
  a giant warehouse. You have a massive heavy lock
• 3:06
  on the front door. That's your perimeter firewall.
• 3:08
  Okay, sounds secure. From the outside, sure.
• 3:10
  But once someone breaks that front lock and walks
• 3:13
  in, there are no internal walls. No locked rooms.
• 3:17
  No security desks. They can just wander around.
• 3:20
  Exactly. They can walk from the reception desk
• 3:22
  straight to the CEO's office without passing
• 3:25
  another checkpoint. Once you are past the perimeter,
• 3:28
  there are no internal barriers. Because everything
• 3:31
  is on the same plane. Right. The intruder can
• 3:33
  move sideways, what we call lateral movement,
• 3:36
  straight to the central databases. And contrast
• 3:39
  that with zero trust. Well, with network segmentation
• 3:42
  or zero trust, you have internal firewalls. If
• 3:45
  an attacker breaches a small primary school out
• 3:47
  in the suburbs, they should be trapped in that
• 3:49
  school's network. But here there was a single
• 3:52
  entry point. Yes. One entry point allowed access
• 3:55
  to a central database covering every student
• 3:57
  in the state. Pierce emphasized this wasn't some
• 4:00
  sophisticated Ocean's Eleven style heist. They
• 4:03
  didn't need to be criminal mastermind. Exactly.
• 4:05
  The centralization of the data without internal
• 4:08
  firewalls just created a massive, easily accessible,
• 4:11
  high value target. It's like putting all your
• 4:13
  eggs in one basket and leaving it in the town
• 4:14
  square. Pretty much. So let's talk about the
• 4:17
  so what factor. Because the government stated
• 4:19
  there is no evidence the data has been released
• 4:22
  publicly yet. That is what we call the nothing
• 4:24
  to see here fallacy. Right. Because David Brow
• 4:28
  wrote a fantastic piece in Information Age about
• 4:30
  this. The long tail of risk. Yes, the long tail.
• 4:33
  Break that down for us. Well, cybercriminals
• 4:36
  today are building dossiers. They aren't always
• 4:39
  looking for a quick payday. They're patient.
• 4:41
  Very patient. They have a student's name, their
• 4:44
  school, and an email address today. They index
• 4:47
  that. Just file it away? Yep. Then maybe next
• 4:50
  year, a different breach happens. Say a local
• 4:53
  sporting club gets hacked, and that leaks a phone
• 4:56
  number. So they cross -reference it. Exactly.
• 4:58
  They stitch it together. And you have to remember,
• 5:00
  today's year nine students are tomorrow's home
• 5:03
  buyers. They're tomorrow's bank account holders.
• 5:06
  That is terrifying. It's profile building. But
• 5:09
  there is also an immediate risk, which is social
• 5:11
  engineering. Phishing emails. Yes, but highly
• 5:15
  targeted ones. Imagine a student gets an email
• 5:18
  that says. Hi, please update your year nine assignment
• 5:21
  password here. And it uses their real name and
• 5:24
  their real school name. It looks completely legitimate.
• 5:27
  Extremely convincing. And that is the real risk
• 5:29
  to the students right now. Okay, so a breach
• 5:32
  of this magnitude obviously doesn't happen in
• 5:34
  a vacuum. It brings us to the regulatory and
• 5:36
  political fallout. And the watchdog did step
• 5:38
  in quickly. They did. The Office of the Victorian
• 5:41
  Information Commissioner, OVC, commenced an official
• 5:44
  investigation on January 22nd. Right. They are
• 5:47
  checking to see if the department upheld its
• 5:49
  obligations under the Privacy and Data Protection
• 5:51
  Act 2014. So it's not just about what the hackers
• 5:54
  did. It's about what the government failed to
• 5:56
  do. Precisely. Did they take reasonable steps
• 5:59
  to secure the data? If a flat network is deemed
• 6:02
  unreasonable, there will be serious regulatory
• 6:05
  consequences. And that spills right over into
• 6:07
  the political arena. We saw some intense debate
• 6:10
  in the Parliament of Victoria. In early February.
• 6:13
  Yes. MP Brad Roswell raised the issue on February
• 6:16
  4th. And as always, we are just looking at the
• 6:20
  facts of the debate here, not taking sides. Of
• 6:22
  course. Roswell's main criticism was aimed at
• 6:25
  the Minister for Education, Ben Carroll. Because
• 6:28
  there was a statement on January 15th, but then
• 6:31
  nothing. Right. Roswell called it radio silence
• 6:34
  regarding the actual scope of the breach and
• 6:36
  how it specifically impacted past versus present
• 6:39
  students. Which is a valid concern when you have
• 6:41
  families waiting for answers. He highlighted
• 6:44
  the risks of foreign actors getting this data
• 6:46
  and the general reputational harm to the state.
• 6:49
  It really shows that managing a cyber incident
• 6:51
  is half IT and half public relations. Oh, absolutely.
• 6:54
  Trust is very easy to lose and very hard to rebuild.
• 6:57
  Now, I want to bring this back to you, the listener.
• 7:00
  Because it is easy to hear about a government
• 7:03
  department with 600 ,000 statements and think,
• 7:05
  well, I run a small logistics firm. This doesn't
• 7:07
  apply to me. But it absolutely does. We looked
• 7:10
  at some insights from Moores and Resilient Services,
• 7:12
  and they point out that other organizations can
• 7:14
  learn a lot from this failure. Moores actually
• 7:17
  outlines common failures that lead to these breaches,
• 7:19
  and they are surprisingly mundane. It's not usually
• 7:22
  zero -day exploits. No, it's human error or old
• 7:26
  information not being destroyed. That stuck out
• 7:29
  to me. The past students being caught up in this
• 7:32
  breach. Why was their data still sitting in an
• 7:35
  active database? Exactly. Archiving or destroying
• 7:38
  old data is crucial. If you don't need it daily,
• 7:41
  it shouldn't be on your primary network. Moore's
• 7:44
  also mentioned the classic problem of spreadsheets
• 7:46
  being emailed around. Yes, instead of using secure
• 7:49
  platforms, sending a spreadsheet full of client
• 7:52
  data to the wrong person on a Friday afternoon
• 7:54
  is a massive risk. So how do we shift our thinking
• 7:57
  on this? Resilient Services talks about the resilience
• 7:59
  mindset. Not if, but when. Right. Reactive responses,
• 8:03
  just trying to fix it after it breaks. are not
• 8:06
  enough anymore you need stress tests stress tests
• 8:08
  proactive planning and training your staff on
• 8:11
  basic cyber hygiene so to synthesize everything
• 8:14
  we've looked at today we are talking about a
• 8:16
  massive breach caused fundamentally by a flat
• 8:19
  network architecture a single loose brick yes
• 8:22
  resulting in a long tail privacy risk for hundreds
• 8:26
  of thousands of students which sparked a major
• 8:28
  investigation and Fierce political debate. It
• 8:31
  is a textbook case of why network segmentation
• 8:34
  matters. Before we sign off, I know you had a
• 8:36
  final provocative thought you wanted to leave
• 8:38
  the listener with today. Something to mull over.
• 8:41
  I do. Think about your own workplace. If a massive
• 8:45
  government department with millions of dollars
• 8:47
  in resources can have a single loose brick bring
• 8:50
  down their entire wall. How secure are the networks
• 8:54
  holding your professional data right now? That
• 8:56
  is a very sobering question. Are your systems
• 8:59
  segmented, or are you running a flat network
• 9:01
  and just hoping the front door holds? Something
• 9:04
  we all need to check on. Thank you so much for
• 9:06
  breaking down the technical side of this incident
• 9:08
  for us. It was a great discussion. And thank
• 9:10
  you all for tuning in to this deep dive on Tech
• 9:12
  Talks with Kinsoft. Yes, thank you for listening.
• 9:14
  Now, if this deep dive raised any red flags about
• 9:17
  your own network architecture, Or, if you want
• 9:20
  to ensure you aren't running a flat network yourself,
• 9:23
  don't wait for a breach to find out. Be proactive.
• 9:26
  Exactly. Go to www .kinsoft .com .au to discuss
• 9:31
  your security and IT needs with the team. Get
• 9:34
  those internal firewalls built. We will see you
• 9:36
  next time. Stay secure out there.