Latest / Tech Talks With Kinsoft / Benedict Industries: Quarry Operations and 2025 Cyber Security Incident

Transcript

Benedict Industries: Quarry Operations and 2025 Cyber Security Incident · Tech Talks With Kinsoft

• 0:00
  Hello and welcome back. It is so good to have
• 0:02
  you with us again for Tech Talks with Kinsoft.
• 0:04
  It's great to be back. Today we're trying to
• 0:05
  make sense of the, well, the pretty complex and
• 0:09
  sometimes frankly scary world of technology.
• 0:12
  And looking at what we're covering today, scary
• 0:14
  might be the right word, though hopefully we
• 0:17
  can steer it towards empowering by the end. I
• 0:20
  hope so. You know, usually I like to ease into
• 0:22
  these discussions. A fun fact, a bit of history,
• 0:25
  something relatable. But looking at the sheer
• 0:27
  volume of reports from late... 2025 and early
• 0:30
  2026 i just don't think we have that luxury we
• 0:34
  kind of need to just rip the band -aid off it
• 0:36
  is looking pretty severe out there isn't it i
• 0:38
  was just reviewing the data for october 2025
• 0:41
  just one month yeah globally we saw over 193
• 0:46
  million records compromised wow 193 million.
• 0:50
  It's hard to even visualize that. And I think
• 0:52
  especially for our listeners here in Australia,
• 0:54
  there can be this sort of island mentality. You
• 0:57
  know, oh, that's a U .S. problem. That's a European
• 0:59
  problem. We're tucked away down here. But we
• 1:02
  are squarely in the crosshairs. And what's really
• 1:04
  alarming about this wave of breaches is just
• 1:07
  the diversity of the targets. We're not just
• 1:10
  talking big banks anymore. We're seeing recycling
• 1:12
  plants, universities. It creates this sense that
• 1:16
  the threat landscape, to use the jargon. is well
• 1:20
  it's everywhere and that's our mission for today
• 1:22
  isn't it yeah we're not here to just list off
• 1:24
  scary stats and make you want to throw your phone
• 1:26
  away we want to unpack the who the how and maybe
• 1:30
  most importantly the why because if you can understand
• 1:33
  the mechanics you can move from panic to strategy
• 1:36
  exactly panic paralyzes awareness empowers that's
• 1:40
  the goal So let's get into it. I want to start
• 1:42
  with a case that really it really challenged
• 1:44
  my own assumptions about who gets hacked. It
• 1:46
  wasn't a bank. It wasn't a tech company. It was
• 1:48
  a company called Benedict Industries. Yes. The
• 1:51
  Benedict Industries breach. That one surfaced
• 1:53
  around October 10th, 2025. So for anyone who
• 1:56
  doesn't know the name, Benedict is a recycling,
• 1:59
  landscaping and civil construction company in
• 2:01
  New South Wales. Based in Belrose. They deal
• 2:03
  in sand, soil, gravel. I mean, it feels like
• 2:06
  the most physical analog business you could possibly
• 2:09
  imagine. And yet this hacking group, INC Ransom,
• 2:13
  claim they stole 270 gigabytes of their data.
• 2:16
  This is the perfect example to dismantle a really
• 2:19
  dangerous myth. Which is? The myth that my business
• 2:22
  is too boring to hack. I hear it all the time
• 2:24
  from business owners. You know, I sell dirt.
• 2:26
  Why would an international cyber gang care about
• 2:28
  me? Well, it seems logical on the surface, doesn't
• 2:31
  it? If I'm a hacker, I want credit card numbers
• 2:33
  or state secrets, not invoices for gravel. That's
• 2:36
  the movie version of hacking. In reality, these
• 2:39
  groups run like businesses. They want leverage.
• 2:41
  And while Benedict Industries might sell sand,
• 2:44
  they employ people. And that means they have
• 2:46
  HR data. Exactly. When you look at what was stolen,
• 2:50
  it wasn't blueprints for a quarry. It was payroll
• 2:52
  data, workers' compensation records. And there
• 2:55
  was one detail in the report that really just,
• 2:57
  it turned my stomach. They access details of
• 3:01
  employees' child support deductions. That's the
• 3:03
  detail that changes the whole conversation. It
• 3:05
  shows the granularity of the extortion. It's
• 3:08
  what we call PII, personally identifiable information,
• 3:12
  to a cyber criminal that is liquid gold. But
• 3:17
  why is that gold specifically? Is it just to
• 3:19
  embarrass people? Embarrassment is part of it.
• 3:22
  Sure. But it's more about utility. You can change
• 3:24
  a credit card number. You can change a password.
• 3:26
  You can't change your child support history or
• 3:28
  a worker's comp claim. That data is permanent.
• 3:31
  It's immutable. It allows for identity theft
• 3:33
  that can last for years. So it doesn't matter
• 3:35
  if you run a local bakery or a billion dollar
• 3:38
  tech firm. If you employ people, you hold high
• 3:42
  value data. So INC Ransom gets this data. What's
• 3:45
  their play? Do they just sell it on the dark
• 3:47
  web or is it a more direct squeeze on the company?
• 3:50
  Well, INC Ransom is a big fan of what we call
• 3:52
  double extortion. Okay, let's pause on that.
• 3:54
  Double extortion. What does that actually look
• 3:56
  like for a business owner? So step one is the
• 3:58
  classic ransomware move. They encrypt your systems,
• 4:01
  your screens go black, you get a scary note,
• 4:03
  operations stop. Which is bad enough. It shuts
• 4:05
  the business down. Right. But companies started
• 4:07
  getting good at backups. They'd say, fine, encrypt
• 4:09
  it. We'll just restore from yesterday. So the
• 4:11
  hackers evolved. Step two, the double extortion.
• 4:16
  is stealing the data before they encrypt it.
• 4:18
  Then they say, if you don't pay, we won't just
• 4:21
  keep your files locked. We will publish them
• 4:23
  to the world. Which they did. In the Benedict
• 4:25
  case, they actually published it. They did, October
• 4:27
  9th and 10th. And that puts the victim in an
• 4:30
  impossible position. Even if your IT team is
• 4:33
  amazing and restores your systems, the privacy
• 4:35
  of your staff is already gone. It's a checkmate.
• 4:38
  So the technical fix isn't enough. It's a PR
• 4:40
  crisis, a legal crisis all at once. Speaking
• 4:44
  of pressure and vulnerable groups, let's pivot
• 4:47
  to another sector that was just besieged in late
• 4:50
  2025. Education. Oh, the education sector has
• 4:53
  become one of the top targets for these groups.
• 4:55
  Absolutely. We have to talk about Western Sydney
• 4:57
  University. This story is just wild, not just
• 5:00
  because of the breach, but the timeline. The
• 5:03
  access actually happened between June and September
• 5:05
  2025. That's right. A really sustained period
• 5:08
  of access. But we didn't hear about it until
• 5:10
  October. Now, usually when a company hides a
• 5:13
  breach, there's public outrage. But in this case,
• 5:16
  the delay was requested by the NSW police. Correct.
• 5:20
  And that's a fascinating wrinkle. The police
• 5:22
  were actively monitoring the perpetrators inside
• 5:25
  the system. It wasn't negligence. It was an active
• 5:28
  law enforcement op. Which makes sense. Right.
• 5:30
  But... Put yourself in a student's shoes. You
• 5:33
  find out months later your data was taken. And
• 5:36
  it's not your grades. It's tax file numbers,
• 5:39
  passport details, health information. For about
• 5:42
  10 ,000 students and staff, that's a small town's
• 5:45
  worth of sensitive data. And this is where it
• 5:47
  gets really dark. The fallout wasn't just data
• 5:49
  theft. The hackers used that data to launch a
• 5:52
  psychological attack. You're talking about the
• 5:54
  phishing campaign that followed. Yes. Students
• 5:56
  started getting emails using stolen contact info
• 5:59
  claiming their degrees had been revoked. Imagine
• 6:01
  getting that email during exam week. It's incredibly
• 6:04
  sophisticated social engineering. They used real
• 6:07
  student IDs, real course names. It just creates
• 6:10
  chaos. And this raises an important point about
• 6:13
  why universities are such juicy targets. Think
• 6:15
  about the demographic. Young people. Exactly.
• 6:18
  18 to 22 -year -olds. They usually have thin
• 6:21
  credit files. Their credit history is a blank
• 6:24
  slate. So they're a blank canvas for fraudsters.
• 6:27
  Precisely. It's a goldmine for identity theft.
• 6:30
  You could take out loans in their name for years
• 6:32
  before they'd even notice because most students
• 6:33
  aren't checking their credit reports. That's
• 6:35
  terrifying. And it wasn't just WSU. There was
• 6:38
  the VTRAC incident around the same time. Correct.
• 6:41
  And VTRAC shows us a different kind of vulnerability.
• 6:45
  They're a software provider for student management.
• 6:47
  When they got hit, it caused a nationwide outage.
• 6:51
  So this wasn't just one school. No. Hundreds
• 6:53
  of training organizations across the country
• 6:55
  couldn't access their own data. They couldn't
• 6:58
  mark attendance, couldn't issue certificates.
• 7:00
  It really highlights that ripple effect. One
• 7:02
  provider goes down and an entire industry is
• 7:05
  in the dark. That's the perfect segue to what
• 7:08
  I think is the most critical theme of late 2025,
• 7:11
  the supply chain risk, or as I like to call it,
• 7:14
  the Trojan horse. The Trojan horse. I like that
• 7:17
  because when we look at the headlines, we see
• 7:20
  big names, Qantas. BMW. These are massive corporations
• 7:24
  with huge security budgets. How are they getting
• 7:27
  breached? They're not getting breached through
• 7:29
  the front door. They're getting breached through
• 7:30
  the service entrance, through the vendors they
• 7:33
  trust. Let's look at Quantas. The breach in mid
• 7:36
  2025, 5 .7 million customer records. That's the
• 7:40
  one. But Qantas itself wasn't hacked. Their own
• 7:43
  servers were secure. It was a third party contact
• 7:46
  center, a company they hired to handle calls
• 7:48
  that was compromised. So you hand over the keys
• 7:50
  to the database and suddenly 5 .7 million frequent
• 7:53
  flyer numbers are out in the wild. Exactly. It's
• 7:56
  like installing a bank vault door on your house,
• 7:58
  but giving the spare key to a dog walker who
• 8:01
  leaves it on a park bench. The Attackers, a group
• 8:04
  with the bizarre name Scattered Lapsus Hunters.
• 8:07
  Sounds like a bad 90s band name. It basically
• 8:09
  is. It's a mix of members from older groups.
• 8:11
  They declared a war on Australia, and their method
• 8:14
  was to hit the supply chain. Qantas can have
• 8:17
  the best firewall in the world, but if their
• 8:19
  vendor has a weak password, the data is gone.
• 8:22
  Same story with BMW, right? Yes. September 2025,
• 8:25
  600 ,000 lines of audit data leaked. Again, not
• 8:28
  BMW's servers, but a third -party provider. So
• 8:31
  what does this mean for a business owner listening?
• 8:33
  If you can't trust your vendors, who can you
• 8:36
  trust? It means the whole concept of perimeter
• 8:38
  security is dead. Your security is only as strong
• 8:41
  as your least secure vendor. The stats show that
• 8:45
  60 percent of major breaches in late 2025 involve
• 8:48
  third parties. 60 percent. That's a clear majority.
• 8:50
  It is. It means you have to audit your partners
• 8:53
  as rigorously as you audit yourself. You have
• 8:56
  to ask the hard questions before you sign the
• 8:57
  contract. I want to zoom out a bit and look at
• 9:00
  the who behind this. We mentioned INC Ransom
• 9:02
  and the Scattered Labs as hunters. It feels like
• 9:04
  there's a new gang every week. It's a crowded
• 9:06
  marketplace. We saw activity from Quillen, Medusa,
• 9:09
  Lynx. They're all competing for market share.
• 9:12
  And no industry is off limits. We've talked construction,
• 9:14
  education. But healthcare took a real beating.
• 9:18
  Genie IVF, 940 gigabytes stolen. That one is
• 9:21
  particularly distressing. We talked about PII.
• 9:24
  But IVF treatment data. That's so incredibly
• 9:28
  private, so emotional. To have that exposed is
• 9:32
  a violation on a whole different level. It's
• 9:34
  just cruel. And then the legal sector. Kelly
• 9:37
  Legal. Brighton's lawyers. Lawyers are a prime
• 9:40
  target. They hold everyone's secrets, but they
• 9:42
  also can't afford downtime. Time is literally
• 9:45
  money for them, so they're statistically more
• 9:47
  likely to pay a ransom quickly. There was also
• 9:50
  a really concerning case with Dodo and iPrimus
• 9:52
  in October. This wasn't just data theft. It was
• 9:55
  a functional attack on our infrastructure. Yes,
• 9:57
  the SIM swapping attacks. Can you just explain
• 10:00
  that? I think people hear SIM swap and think
• 10:01
  someone physically stole their phone card. It's
• 10:04
  purely digital. The hackers got into customer
• 10:07
  email accounts. Then they just contacted the
• 10:09
  telco, pretended to be the customer, and asked
• 10:12
  to move the mobile number to a new SIM card that
• 10:14
  the hacker controlled. So my phone suddenly goes
• 10:16
  dead, and the hacker's phone lights up with my
• 10:19
  number. Exactly. And they want your number for
• 10:20
  one reason, for two -factor authentication codes.
• 10:23
  Oh, wow. So when my bank sends a code to my mobile,
• 10:28
  It goes straight to the hacker. Correct. It completely
• 10:30
  bypasses the security we all rely on. It's a
• 10:33
  direct attack on identity verification. It's
• 10:35
  terrifyingly clever. But, you know, as we talk
• 10:38
  about these sophisticated groups, there's another
• 10:40
  stat you highlighted that caught my eye. 37 %
• 10:42
  of notifications to the regulator were just human
• 10:46
  error. Yes. We cannot forget the human element.
• 10:49
  We worry about these cyber gangs. But a huge
• 10:51
  chunk of breaches happen because someone CC'd
• 10:54
  the wrong person or left a laptop on a train.
• 10:58
  Or clicked a bad link. The oops factor. It is.
• 11:01
  And in the industrial sector, that oops can stop
• 11:04
  physical production. Look at Jaguar Land Rover
• 11:07
  in the UK. Cyber attacks stopped the assembly
• 11:09
  lines. This is where IT meets OT, operational
• 11:12
  technology. When the computers go down, the factory
• 11:16
  stops. OK, I feel like we painted a very grim
• 11:17
  picture. It feels like the Wild West. Please
• 11:19
  tell me there's a sheriff coming to town. Is
• 11:20
  anyone fighting back? There is absolutely pushback.
• 11:23
  The government and industry are waking up. October
• 11:25
  was Cybersecurity Awareness Month, and we saw
• 11:27
  some really significant policy shifts. I saw
• 11:30
  we have a new Cyber Incident Review Board. What's
• 11:32
  their job? Just handing out fines. Quite the
• 11:35
  opposite, actually. Think of them like air crash
• 11:37
  investigators for cyber attacks. They do no fault
• 11:41
  reviews. The goal isn't to punish the victim.
• 11:44
  It's to learn from it so everyone else can be
• 11:46
  prepared. That's crucial because usually companies
• 11:49
  just want to hide it so no one learns a lesson.
• 11:51
  Exactly. We need to share intelligence. We also
• 11:55
  have a new ambassador for cyber affairs, Jessica
• 11:58
  Hunter. She comes from an intelligence background,
• 12:01
  which signals the government sees this as a national
• 12:03
  security issue. So if I'm listening to this,
• 12:05
  what's the mindset shift I need to make? What's
• 12:08
  the strategy? You need to move away from just
• 12:10
  protecting the perimeter. The old model was building
• 12:13
  a high wall. The new mentality from the essential
• 12:16
  eight framework is assume compromise. Assume
• 12:19
  compromise. Yeah. That sounds pessimistic. It's
• 12:22
  realistic. It means assume they're already in
• 12:24
  or they will get in. So do you have the systems
• 12:27
  to detect them? Can you limit the damage? Are
• 12:29
  your backups offline so they can't be encrypted
• 12:31
  to? So it's like having motion detectors inside
• 12:33
  the house, not just a lock in the front door.
• 12:35
  Precisely. Because with the rise of AI, that
• 12:38
  front door is getting a lot harder to defend.
• 12:41
  How is AI changing the game? Well, generative
• 12:44
  AI lets hackers scale up phishing attacks. You
• 12:47
  know those scam emails full of typos? Dear sir,
• 12:51
  I am a prince ones. The ones that were easy to
• 12:54
  spot. Yeah. Well, now AI writes perfect, persuasive,
• 12:57
  context -aware emails. It can scrape your LinkedIn,
• 13:00
  see you just went to a conference, and write
• 13:02
  an email saying, great meeting you there. Here's
• 13:04
  that file we discussed. So that 37 % human error
• 13:07
  stat could go way up if the scams get better.
• 13:11
  It absolutely could, which is why training and
• 13:13
  culture are just as important as firewalls. You
• 13:15
  need a culture where people aren't afraid to
• 13:17
  ask. Does this look right? It really is a constant
• 13:20
  evolution. It is. But I want to emphasize it's
• 13:22
  a race you can survive. It's about resilience,
• 13:24
  not invincibility. That's a great way to frame
• 13:27
  it. Resilience. Whether you're a recycling plant
• 13:29
  or a university or an airline, the reality is
• 13:32
  clear. Data is currency. And your supply chain
• 13:35
  is likely your weakest link. And navigating this
• 13:38
  isn't something you can just do on the fly. It
• 13:40
  requires expertise, strategy, and... And honestly,
• 13:44
  it requires help. Absolutely. You don't want
• 13:46
  to wait until you're a headline to start thinking
• 13:48
  about this. The cost of prevention is just a
• 13:50
  fraction of the cost of recovery. That is the
• 13:53
  truth. If you're listening and thinking, I don't
• 13:55
  know if my vendors are secure or I don't know
• 13:57
  if we could spot an intruder, you need to bring
• 13:59
  in experts. We highly recommend you head over
• 14:02
  to www .kinsoft .com .au. That's www .kinsoft
• 14:07
  .com .au. They can help you discuss your security
• 14:11
  and IT needs and make sure you don't become the
• 14:13
  next case study we talk about on this show. Exactly.
• 14:16
  Don't be the boring business that gets hacked.
• 14:18
  Be the boring business that stays secure. I like
• 14:21
  that. Security should be boring. Boring is good.
• 14:24
  Before we go, here's a thought to leave you with.
• 14:26
  We've talked about data theft and encryption.
• 14:29
  But when attackers start messing with SIM cards
• 14:31
  and launching psychological attacks, we have
• 14:34
  to ask. What happens when the goal isn't just
• 14:36
  to steal your data, but to make you doubt the
• 14:39
  data you still have? That's a chilling thought.
• 14:41
  The integrity of reality itself becomes the target.
• 14:44
  Something to mull over. Thank you for joining
• 14:46
  us. This has been Tech Talks with Kinsoft. Stay
• 14:49
  safe out there. Goodbye, everyone.