Latest / Tech Talks With Kinsoft / Luxury Brands Under Siege: Data Breaches Widespread

Transcript

Luxury Brands Under Siege: Data Breaches Widespread · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. We're the
• 0:01
  place where we try to make sense of complex tech
• 0:04
  topics and pull out the insights that really
• 0:06
  matter for you. Today, we're jumping into something
• 0:08
  that's been all over the news, probably got you
• 0:10
  thinking about your own online safety too. We're
• 0:13
  talking about this recent wave of pretty serious
• 0:15
  data breaches hitting some big names, major luxury
• 0:19
  brands, global companies. You've probably seen
• 0:21
  the headlines, but we want to get beyond that,
• 0:24
  look at the deeper story. How do these attacks
• 0:26
  actually happen? Why is your data maybe sitting
• 0:29
  with these companies, such a target? And what
• 0:31
  does it all really mean? That's exactly right.
• 0:33
  We've been digging through quite a few reports,
• 0:35
  analyses, looking at this trend. And it is concerning.
• 0:39
  You see these really sophisticated cyber attacks
• 0:41
  hitting well -known companies like Chanel, Louis
• 0:43
  Vuitton, even Qantas. So our goal today is...
• 0:48
  to pull out the patterns we're seeing, expose
• 0:50
  the methods these attackers are using because
• 0:52
  they are evolving, and maybe most importantly,
• 0:55
  give you some practical knowledge, things you
• 0:57
  can actually use to protect yourself better online,
• 0:59
  because it really isn't just about these big
• 1:01
  corporations. It's about your personal information.
• 1:04
  Okay, let's start there then. Let's look at Chanel.
• 1:06
  They recently confirmed a breach, right, affecting
• 1:08
  U .S. clients. Yes, discovered July 25th. Unauthorized
• 1:12
  access, but interestingly, it was to a database
• 1:15
  hosted by a third -party provider. Not Chanel's
• 1:18
  main systems directly, it seems. And what kind
• 1:20
  of data was involved? Names, email addresses,
• 1:22
  mailing addresses, phone numbers, stuff people
• 1:24
  gave when they contacted the U .S. Client Care
• 1:26
  Center. The good news, relatively speaking, is
• 1:29
  that they stated no financial details were compromised
• 1:32
  in this specific instance. Okay, but still, names,
• 1:36
  addresses, phone numbers, that's quite a bit.
• 1:38
  Why luxury brands, though? Why are they such
• 1:41
  attractive targets? Is it just about getting
• 1:43
  lists of wealthy people? Well, that's part of
• 1:46
  it, sure. High net worth individuals are seen
• 1:48
  as valuable targets themselves. But it's more
• 1:52
  than just that. Attackers can use this kind of
• 1:54
  detailed personal data, maybe combine it with
• 1:57
  purchase history if they get that, to craft really
• 1:59
  convincing scams, targeted phishing, social engineering.
• 2:02
  Ah, so the data itself allows for more sophisticated
• 2:05
  follow -on attacks. Exactly. Plus, think about
• 2:08
  the brand reputation. Luxury brands thrive on
• 2:11
  trust, exclusivity. Damage that, and you create
• 2:14
  leverage for extortion. And a really critical
• 2:17
  thread here, something we're seeing again and
• 2:19
  again, including with Chanel, is this link to
• 2:21
  third -party service providers. Specifically,
• 2:23
  Salesforce instances seem to be involved quite
• 2:26
  often, as Bleeping Computer reported. Right,
• 2:28
  Salesforce. So it's not necessarily Salesforce
• 2:30
  itself being hacked. but how companies use Salesforce.
• 2:34
  Precisely. That's the key distinction. It's a
• 2:36
  supply chain vulnerability. Salesforce has been
• 2:39
  pretty clear in their statements. They say their
• 2:40
  core platform is secure. They're pointing towards
• 2:43
  issues not being down to a known flaw in their
• 2:45
  system, but more about how customers manage their
• 2:48
  security settings. So customer responsibility.
• 2:51
  Yes. They're highlighting the rise in sophisticated
• 2:54
  phishing and social engineering. targeting their
• 2:57
  clients' employees. And Salesforce is urging
• 2:59
  customers, you know, follow best practices. Use
• 3:03
  multi -factor authentication, that's MFA or 2FA,
• 3:06
  that extra code or confirmation. Enforce least
• 3:09
  privilege access, meaning people only get access
• 3:11
  to exactly what they need for their job, nothing
• 3:14
  more. And crucially, monitor those connected
• 3:16
  apps very closely. It makes sense for Salesforce
• 3:19
  to emphasize customer responsibility. But you
• 3:22
  wonder, these platforms are powerful but complex.
• 3:24
  Could that complexity itself create openings
• 3:27
  even for companies trying to do the right thing?
• 3:29
  That's a really sharp point. Power and flexibility
• 3:31
  often come hand in hand with complexity. Misconfigurations,
• 3:35
  maybe just not keeping up strictly with best
• 3:38
  practices. Yeah, that can definitely create gaps
• 3:40
  attackers can exploit. And this ties into who's
• 3:43
  actually doing this. The Chanel breach, for instance,
• 3:45
  seems to be part of a larger case. campaign.
• 3:47
  It's been attributed to the shiny hunters group.
• 3:51
  Shiny hunters. They've been around for a while,
• 3:52
  known for data theft, extortion. That's them.
• 3:55
  But what's really interesting and maybe a bit
• 3:57
  confusing is that there were reports back in
• 4:00
  late June 2025 of arrests linked to shiny hunters
• 4:04
  and their forum, breach forums. Arrests. But
• 4:08
  the attacks are still happening. Apparently so,
• 4:10
  which raises big questions, doesn't it? How are
• 4:12
  they pulling this off despite law enforcement
• 4:14
  action? Yeah, what does that tell us? Well, it
• 4:16
  might suggest these groups are more decentralized
• 4:18
  than we think. Maybe arresting one or two key
• 4:20
  figures doesn't stop the whole operation. Or
• 4:23
  perhaps others just pick up the mantle. It highlights
• 4:26
  this constant cat and mouse game. And Google's
• 4:29
  threat intelligence group, GTIC, they reported
• 4:31
  in June on a group called UNC6040, which seems
• 4:34
  linked to these attacks. They're using some pretty
• 4:37
  sophisticated social engineering, mostly phishing,
• 4:40
  that's voice phishing, over the phone and regular
• 4:43
  email phishing, often pretending to be IT support.
• 4:46
  So they're actually calling employees or sending
• 4:49
  emails that look like they're from internal tech
• 4:51
  support. That's bold. Incredibly bold and effective.
• 4:54
  They trick employees into going to Salesforce's
• 4:57
  connected app. Setup page. Then they get the
• 5:00
  employee to enter a connection code. This code
• 5:02
  links a malicious OOTH app. Okay, hang on. OOTH
• 5:05
  app, what does that do exactly? Think of it like
• 5:08
  giving permission. You know how sometimes you
• 5:10
  sign into a new website using your Google or
• 5:13
  Facebook account? That uses OOTH. You're granting
• 5:17
  that website limited access to some of your Google
• 5:19
  or Facebook info without giving it your main
• 5:22
  password. Here, the attackers trick the employee
• 5:25
  into granting their malicious app permission
• 5:27
  to access data within the company's Salesforce
• 5:29
  system. Wow. And they disguise the app. Yeah.
• 5:33
  Often as something harmless sounding like My
• 5:35
  Ticket Portal. Once it's connected, the attackers
• 5:37
  can just siphon off sensitive customer data from
• 5:39
  the CRM system. So the CRM, the Customer Relationship
• 5:43
  Management System, that's where all the customer
• 5:45
  details live. Names, contact info, maybe purchase
• 5:48
  history. Exactly. It's the crown jewels of customer
• 5:51
  data. for many companies. And it's not just the
• 5:54
  OOOTH trick. They're also stealing login credentials
• 5:56
  and those MFA tokens, the one time codes using
• 5:59
  fake login pages that look identical to the real
• 6:02
  thing. That makes it incredibly hard for an ordinary
• 6:04
  employee to spot. They're exploiting human trust.
• 6:07
  Absolutely. It's less about breaking down technical
• 6:10
  walls sometimes and more about just walking through
• 6:12
  the front door because someone held it open for
• 6:14
  you, essentially. And this isn't just Chanel.
• 6:16
  You mentioned this is a wider campaign. Oh, yes.
• 6:19
  We've seen a whole string of major brands disclosing
• 6:22
  similar breaches in recent months. LVMH subsidiaries
• 6:25
  think Louis Vuitton, Dior, Tiffany & Co. Tiffany
• 6:30
  Korea specifically mentioned a vendor platform
• 6:32
  being infiltrated. Adidas, Qantas, Allianz Life.
• 6:36
  All reporting breaches link to these third -party
• 6:38
  CRM platforms. It really does look like a coordinated
• 6:41
  effort using a similar playbook. The scale is
• 6:43
  quite something. Louis Vuitton, for example,
• 6:45
  that breach had a huge international footprint,
• 6:47
  didn't it? Massive. Confirmed July 2nd, 2025.
• 6:50
  It hit customers in Australia, Hong Kong, where
• 6:54
  they said 419 ,000 customers were impacted. South
• 6:57
  Korea, Turkey, the UK, Italy, Sweden, Spain,
• 7:00
  New Zealand. Pretty much global. And what data
• 7:03
  was exposed there? Similar to Chanel? Similar,
• 7:05
  but maybe even broader in some ways. Full names,
• 7:09
  gender, country, postal addresses, emails, phone
• 7:12
  numbers, date of birth, purchase history. Again,
• 7:15
  they stated no passwords or financial details
• 7:17
  directly. But worryingly, in some cases, passport
• 7:21
  numbers were also exposed. Passport numbers.
• 7:24
  Okay, that really elevates the risk. Identity
• 7:27
  theft becomes a much bigger concern. Absolutely.
• 7:30
  And you saw the customer reaction, right, especially
• 7:32
  in Australia, where some people apparently didn't
• 7:35
  get notified for up to 20 days after LV detected
• 7:38
  the breach. 20 days? That seems like a long time.
• 7:41
  It does. And people were understandably upset.
• 7:43
  We saw comments online, like on Reddit, folks
• 7:46
  angry about the sheer amount of data access,
• 7:48
  name, address, date of birth, and questioning
• 7:51
  why companies even need to collect all that unnecessary...
• 7:54
  PII or personally identifiable information in
• 7:57
  the first place. That's a fair point. Does a
• 7:59
  luxury brand really need your date of birth to
• 8:01
  sell you a handbag? It makes you think about
• 8:03
  data minimization. It really does. And then there's
• 8:05
  Qantas, not a luxury brand, but a major airline,
• 8:09
  huge customer base. They also got hit. Right.
• 8:11
  When was that? Between June 30th and July 2nd,
• 8:14
  2025, again via a third -party system, this time
• 8:18
  a contact center system based in Manila, affected
• 8:21
  about 5 .7 million unique customer records. 5
• 8:24
  .7 million? Wow. Yeah. Mostly names, emails,
• 8:28
  frequent flyer details. But for around 1 .7 million
• 8:31
  of those, it also included addresses, dates of
• 8:33
  birth, phone numbers, gender. Qantas also emphasized
• 8:36
  no passwords, credit card details, or passport
• 8:39
  info were taken. So again, that consistent pattern.
• 8:41
  So when you pull back and look at all these incidents
• 8:43
  together, Chanel, LV, Qantas, others, what's
• 8:46
  the big picture here? The big picture is that
• 8:49
  the threat landscape is constantly shifting.
• 8:51
  And supply chain security is maybe one of the
• 8:54
  most critical weak points right now. You just
• 8:57
  have to look at the list of breaches here in
• 8:58
  Australia over the last few years, 2018 to 2025.
• 9:01
  It's relentless. It hits everyone. Homebuilders
• 9:03
  like Metricon, big super funds like REST and
• 9:05
  Australian Super, universities, government agencies.
• 9:08
  It really drives home that your data isn't just
• 9:10
  risked by the company you give it to directly.
• 9:11
  It's risked by their vendors, their service providers,
• 9:14
  that whole interconnected web your data travels.
• 9:16
  That's a sobering thought. So for these brands
• 9:19
  like Chanel, Louis Vuitton, where trust and loyalty
• 9:22
  are everything. How do they even begin to rebuild
• 9:25
  after something like this? It's not just about
• 9:27
  fixing the technical hole, is it? Not at all.
• 9:29
  Communication is absolutely key. Clear, honest,
• 9:32
  timely information about what happened, who was
• 9:35
  affected, what data was involved, and what steps
• 9:38
  customers should take. Any ambiguity or delay
• 9:40
  just makes things worse. And then internally,
• 9:42
  they need robust, tested incident response plans.
• 9:45
  Not just a plan sitting on a shelf, but one they
• 9:47
  actually practice. And cybersecurity training
• 9:50
  for everyone has to be part of the culture, not
• 9:52
  just an IT thing. Even then, the social engineering
• 9:54
  aspect we talked about makes it incredibly tough.
• 9:56
  It really does sound like a constant battle.
• 9:59
  Okay, so let's bring it back to our listeners.
• 10:01
  What can you do? Faced with all this, how can
• 10:04
  you better protect your own digital self? Based
• 10:07
  on what we've discussed today, especially these
• 10:09
  kinds of attacks, here are a few key actions.
• 10:12
  First, passwords. We always say it, but it's
• 10:15
  crucial. Strong, unique passwords for every site.
• 10:19
  Don't reuse them. Use a mix of letters, numbers,
• 10:21
  symbols. And honestly, consider using a password
• 10:24
  manager. It makes managing unique passwords so
• 10:27
  much easier and more secure. That's a great first
• 10:29
  step. Second, two -factor authentication, or
• 10:32
  2FA. Enable it everywhere you possibly can. But
• 10:36
  thinking about how these attackers are trying
• 10:38
  to grab MFA tokens, maybe prioritize the more
• 10:41
  secure types of 2FA if they're offered. Right,
• 10:43
  like authenticator apps on your phone, Google
• 10:46
  Authenticator, Authy, those kinds. Or even better,
• 10:48
  hardware security keys, like YubiKey. They're
• 10:51
  generally seen as stronger than just getting
• 10:53
  a code via SMS text message, which can sometimes
• 10:55
  be intercepted or phished. Good point. Okay,
• 10:58
  third, monitor your accounts. Keep an eye on
• 11:01
  your bank statements, credit card activity, obviously.
• 11:03
  But maybe also check things like your frequent
• 11:06
  flyer balance or loyalty points. Those are targets
• 11:08
  too now. Set up transaction alerts if you can.
• 11:11
  Vigilance is key. Fourth, software updates. Keep
• 11:14
  your phone, your computer, your apps updated.
• 11:17
  Those updates often patch security holes that
• 11:20
  attackers are actively looking for. Don't ignore
• 11:22
  them. Simple but effective. Fifth. Think before
• 11:25
  you share. Be really mindful about what personal
• 11:27
  information you hand over online. Do they really
• 11:30
  need your exact date of birth for that newsletter,
• 11:32
  your full home address for that contest? Given
• 11:35
  how this data is being used in breaches, maybe
• 11:37
  be a bit more reserved if it's not strictly necessary.
• 11:40
  Data minimization on a personal level. Exactly.
• 11:43
  And finally, number six. Be super wary of phishing
• 11:47
  and vishing, those fake emails, texts, even phone
• 11:51
  calls, especially if they mention some personal
• 11:53
  detail they might have gotten from a previous
• 11:55
  breach to sound legitimate, or if they ask you
• 11:57
  to click a link, download something, or provide
• 11:59
  login details or codes. If you're unsure, don't
• 12:02
  click, don't respond. Contact the company directly
• 12:05
  through their official website or phone number
• 12:07
  that you look up yourself. Never use the links
• 12:10
  or numbers in the suspicious message. That skepticism
• 12:12
  is probably your best defense against those social
• 12:14
  engineering tricks. Yeah. You know, looking at
• 12:17
  the scale and the cleverness of these recent
• 12:19
  attacks, it really hits home. Cyber threats aren't
• 12:22
  just some technical issue for the IT folks anymore.
• 12:24
  They're a core business risk, and they're deeply
• 12:27
  personal for all of us. Maybe the question we
• 12:29
  need to ask isn't if our data might get exposed
• 12:31
  in some breach, but when it happens, how ready
• 12:34
  are we to deal with it? I think that's the right
• 12:36
  way to frame it. Understanding how these threat
• 12:39
  actors operate, where the vulnerabilities lie,
• 12:41
  especially in these third -party systems, it
• 12:44
  gives you power. It just underscores the constant
• 12:47
  need for strong security, both for us as individuals
• 12:50
  and for the businesses we interact with. It's
• 12:52
  a shared responsibility, really. Absolutely.
• 12:54
  Well, thank you for joining us on this edition
• 12:56
  of Tech Talks with Kinsoft. If you're thinking
• 12:58
  about your own business's security posture or
• 13:00
  your IT needs in general after hearing all this,
• 13:03
  you can find out more about how we can help at
• 13:05
  www .kinsoft .com .au. Stay informed, stay vigilant
• 13:09
  out there. We'll catch you next time with more
• 13:11
  insights to help you navigate this complex digital
• 13:14
  world.