Latest / Tech Talks With Kinsoft / Degree Revoked: Inside the Western Sydney University Supply Chain Breach

Transcript

Degree Revoked: Inside the Western Sydney University Supply Chain Breach · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. Today, we're
• 0:02
  looking at a year that was, well, a brutal turning
• 0:05
  point for Australian higher education, 2025.
• 0:09
  It really was. We saw the sustained digital siege
• 0:12
  where the tech shifted. It became less about
• 0:14
  just stealing money and more about a... a calculated
• 0:17
  campaign of psychological warfare. And it was
• 0:20
  aimed directly at students and alumni. That's
• 0:22
  the critical shift we saw. And Western Sydney
• 0:25
  University, or WSU, really became the ultimate
• 0:28
  case study. We've got a stack of sources here
• 0:31
  detailing a year -long series of incidents, but,
• 0:33
  I mean, none were as dramatically malicious as
• 0:36
  what happened on October 6th and 7th, 2025. Let's
• 0:39
  just unpack the sheer shock of that moment. Imagine
• 0:42
  you are a listener. You're a busy professional.
• 0:45
  maybe a current student, you check your personal
• 0:47
  inbox, not your uniportal, and there's an official
• 0:49
  looking email. Yeah. And it claims, with no warning,
• 0:52
  that your degree has been revoked and you are
• 0:53
  permanently excluded from the university. The
• 0:55
  panic was just instant. We heard from a WSU student
• 0:58
  who said they felt their entire life and a decade
• 1:00
  of hard work was down the drain. A decade of
• 1:02
  work. But then think about the alumni. The sources
• 1:06
  highlight people who graduated 15 years ago.
• 1:09
  Their professional registration, their entire
• 1:11
  job, depends on that degree. And suddenly they're
• 1:15
  wondering if their whole career foundation just
• 1:17
  vanished. And what's so fascinating here, so
• 1:20
  disturbing, is the motivation. The WSU vice chancellor
• 1:23
  confirmed it. The whole point of this scam was
• 1:26
  purely to harm our students and alumni, just
• 1:29
  to damage the university's reputation. Right.
• 1:31
  There was no follow -up asking for ransom, no
• 1:34
  link saying, pay us to get your degree back.
• 1:36
  Nothing. It was just emotional collateral damage,
• 1:39
  targeted destruction. It just raises the question,
• 1:41
  why go to all that effort? just for reputational
• 1:45
  harm. Because it's incredibly effective. I mean,
• 1:47
  psychological warfare is, from an attacker's
• 1:49
  perspective, very resource efficient. You get
• 1:52
  maximum damage, panic, erosion of public trust
• 1:54
  for a minimal technical cost, especially if you're
• 1:57
  using data that was already stolen in a previous
• 2:00
  attack. OK, so let's analyze how this email attack
• 2:03
  was pulled off so effectively. It wasn't just
• 2:05
  mass spam. It was frighteningly convincing. It
• 2:08
  was. And they succeeded because of the personalization.
• 2:12
  The emails had personal identifiers that proved
• 2:15
  the attacker had deep access. They used the recipient's
• 2:18
  full name and, this is the critical part, their
• 2:21
  unique student number. Right. If an email...
• 2:24
  As a fact that only your university should know,
• 2:27
  your guard just drops instantly. Instantly. And
• 2:30
  the second layer of credibility was the delivery
• 2:32
  method itself. It wasn't coming from some, you
• 2:34
  know, typo riddled hotmail address. No, it looked
• 2:36
  real. It was real in a sense. The attackers used
• 2:39
  the university's own infrastructure. The emails
• 2:42
  came from a legitimate verified WSU address,
• 2:45
  something like no email at westernsydney .edu
• 2:47
  .au. They got into an internal automatic email
• 2:50
  generator and just fed it the stolen student
• 2:53
  data. Wow. So they weaponized the university's
• 2:56
  own communication system against its community.
• 2:58
  But the story gets even stranger because there
• 3:01
  was a second mass email right after. That's the
• 3:03
  intriguing twist. This next email, on October
• 3:06
  7th, came from the university's parking permits
• 3:09
  account. And it was actively criticizing WSU.
• 3:13
  The center claimed they used the exact same vulnerability
• 3:16
  and alleged the university had known about these
• 3:18
  security weaknesses since 2017. So it was almost
• 3:21
  like a protest hack. Trying to publicly expose
• 3:24
  the security failures. It was definitely framed
• 3:26
  that way. The message claimed the flaws were,
• 3:29
  and I'm quoting here, easily exploited with just
• 3:32
  a few clicks. It just reinforced this idea that
• 3:35
  WSU systems were fundamentally broken. Now, WSU,
• 3:38
  to their credit, did respond quickly. They came
• 3:41
  out, said it was fraudulent, that everyone's
• 3:43
  awards were safe. And their immediate step was
• 3:45
  to just shut that email generator down. Which
• 3:47
  they said prevented many thousands of additional
• 3:49
  emails from being sent. And they immediately
• 3:52
  called in the NSW police cybercrime squad. But
• 3:55
  to really get how they. could personalize those
• 3:57
  messages, we have to look backwards. This was
• 4:00
  all built on a treasure trove of data stolen
• 4:02
  earlier in the year. And this is where the supply
• 4:05
  chain risk just comes into sharp, painful focus.
• 4:08
  The scam emails were only possible because of
• 4:10
  a much bigger theft that WSU was already dealing
• 4:13
  with. Precisely. We need to rewind a bit to a
• 4:15
  massive protracted breach between June 19th and
• 4:18
  September 3rd, 2025. The target then was WSU's
• 4:23
  student management system. And crucially, that
• 4:25
  system wasn't even managed by WSU directly. No.
• 4:28
  And that complicated things hugely. It's the
• 4:30
  definition of a supply chain nightmare. The student
• 4:33
  management system was hosted by a third party
• 4:35
  provider on a commercial cloud platform. But
• 4:38
  the sources suggest the attackers didn't even
• 4:40
  breach that third party directly. They got in
• 4:42
  via further external systems. So we're talking
• 4:45
  about a fourth, maybe even a fifth party vendor.
• 4:47
  Exactly. An attacker exploits a vulnerability
• 4:50
  in a contractor who works for a vendor who runs
• 4:53
  a system for the universe. It makes tracing the
• 4:55
  origin exponentially harder, right? Absolutely.
• 4:58
  The vulnerability could have been anything. An
• 5:00
  unpatched API, compromised credentials from a
• 5:03
  small maintenance firm, and that let them just
• 5:05
  waltz past WSU's own defenses and get to the
• 5:08
  crown jewels. And when you look at the list of
• 5:10
  what data was compromised, the alarm bells should
• 5:13
  be screaming for everyone listening. This wasn't
• 5:14
  just names and email addresses. No. No, this
• 5:17
  was data that enables complete identity theft.
• 5:20
  We're talking tax file numbers, TFNs, bank account
• 5:23
  details, driver license and passport details,
• 5:26
  visa information. That's permanent identity collateral.
• 5:29
  You can't just cancel your TFN like a credit
• 5:32
  card. Exactly. And it wasn't just financial.
• 5:35
  They got health and disability information, ethnicity
• 5:37
  data, employment and payroll details. They didn't
• 5:40
  just grab a student directory. They grabbed entire
• 5:43
  life files, perfect for the most sophisticated
• 5:45
  fraud. It's clear this was the ammunition for
• 5:47
  the October attack. But you said WSU's vice chancellor
• 5:50
  described them as being under repeated attack.
• 5:53
  So this June to September breach was just one
• 5:56
  chapter in a much longer story. It was a continuous
• 5:58
  battle all through 2025. We know that earlier
• 6:01
  in the year, around Jan and Feb, there was another
• 6:03
  breach. That one hit about 10 ,000 students through
• 6:06
  the single sign -on system. And then there was
• 6:08
  that high -profile arrest in June. Yes, on June
• 6:11
  25th, police arrested a former student, Kira
• 6:14
  Kingston, and charged her with over 20 cyber
• 6:17
  crimes against WSU. But here's the key detail.
• 6:21
  WSU confirmed that the attacks continued even
• 6:24
  after she was arrested. And that's critical.
• 6:27
  It proves WSU wasn't just fighting one disgruntled
• 6:30
  student. They were up against multiple distinct
• 6:32
  professional threat actors. Probably large -scale
• 6:35
  organized crime. It's the only conclusion that
• 6:37
  makes sense. And WSU, well, they weren't alone
• 6:40
  in 2025. This was a systemic crisis hitting the
• 6:43
  entire Australian education sector. The stats
• 6:46
  really back that up. The education sector reported
• 6:48
  44 notifiable data breaches. in just the first
• 6:51
  half of 2024, and it just got worse from there.
• 6:54
  Let's look at a couple of other cases. Sure.
• 6:56
  First, in January 2025, the University of Notre
• 6:59
  Dame Australia was hit. They were a victim of
• 7:01
  the Fog ransomware group. And what's interesting
• 7:03
  about Fog is their speed. They specialize in
• 7:06
  exploiting things like compromised VPN credentials,
• 7:09
  and they can go from getting in to encrypting
• 7:12
  everything in, well, sometimes under two hours.
• 7:14
  Two hours. That leaves you basically zero time
• 7:16
  to detect or respond. What was the impact there?
• 7:18
  It was immediate. They stole TFNs and medical
• 7:21
  documents. But operationally, students reported
• 7:24
  weeks of disruption. They couldn't get their
• 7:26
  timetables, couldn't access portals right before
• 7:29
  the semester started. A crippling blow. Now,
• 7:32
  contrast that with the Albright Institute of
• 7:34
  Language and Business in February. This shows
• 7:36
  that being small doesn't keep you safe. Correct.
• 7:39
  Albright, a smaller private institution, was
• 7:43
  targeted by Kilsec Ransomware. And Kilsec is
• 7:46
  important because they operate as ransomware.
• 7:48
  somewhere as a service, or ray. Can you just
• 7:50
  quickly define RAISE for our listeners? Yeah.
• 7:53
  Think of it like a franchise model for cybercrime.
• 7:55
  A group like KILSEC builds the nasty ransomware
• 7:58
  tools, the infrastructure, the payment portals,
• 8:00
  and then they lease access to affiliates who
• 8:02
  are other criminals that actually carry out the
• 8:04
  attacks. It just massively lowers the barrier
• 8:06
  to entry. And the data they went after at Albright
• 8:08
  really shows the vulnerability of institutions
• 8:10
  that have a lot of international students. Absolutely.
• 8:13
  The data KILSEC published included passport scans,
• 8:17
  visa application documents. incredibly sensitive
• 8:20
  immigration files, that information is uniquely
• 8:23
  valuable for organized crime. So this brings
• 8:26
  us back to that core question. Why? Why is the
• 8:30
  Australian education sector such a huge target?
• 8:32
  It's really a perfect storm of four factors.
• 8:34
  First, the sheer volume of high value personal
• 8:37
  data, like we discussed, TFNs, health info, passports.
• 8:41
  Second is the lure of intellectual property.
• 8:44
  I mean, universities are doing cutting edge research,
• 8:46
  defense, health, tech. Prime targets for state
• 8:51
  -sponsored espionage. And the third factor is
• 8:54
  just the complexity of their networks. Exactly.
• 8:56
  They run these sprawling, complex IT environments
• 8:59
  for tens of thousands of users. Students, staff,
• 9:02
  researchers, alumni, all connecting with different
• 9:04
  devices. It creates a massive attack surface.
• 9:07
  And fourth, as the WSU case proved, that critical
• 9:10
  reliance on third -party vendors. The supply
• 9:12
  chain. The supply chain. Securing your own perimeter
• 9:14
  is only half the battle. So given these persistent,
• 9:17
  sophisticated attacks, what are the universities
• 9:19
  doing to fight back? This can't be cheap. Oh,
• 9:22
  it is astronomically expensive. WSU's vice chancellor
• 9:26
  said they spent $26 million on cyber uplift in
• 9:30
  2025 alone, and they budgeted a similar amount
• 9:32
  for 2026. That includes hiring top tier external
• 9:36
  consultants, complete security governance reviews.
• 9:39
  26 million. That's a staggering investment. Is
• 9:42
  it even realistic for a smaller place like the
• 9:45
  Albright Institute to meet that kind of budget?
• 9:47
  Or are they just fundamentally left vulnerable?
• 9:50
  That is the big strategic challenge for the whole.
• 9:52
  sector. But WSU's investment does give us a useful
• 9:55
  blueprint. We can look at the specific security
• 9:57
  uplifts they talked about in their public notifications.
• 9:59
  So what were the practical changes they made?
• 10:01
  A heavy focus on identity and access management.
• 10:04
  So a massive forced reset of system credentials
• 10:07
  and access tokens across the board. They also
• 10:10
  brought in stronger authentication requirements
• 10:11
  and crucially, much stricter controls over privileged
• 10:14
  accounts. Which is just limiting who has the
• 10:16
  keys to the kingdom. Exactly. They also moved
• 10:19
  heavily into preparedness, running response simulations
• 10:22
  and really focusing on proactive supply chain
• 10:25
  cyber reviews, not just waiting for a vendor
• 10:27
  to tell them there's a problem. And they implemented
• 10:29
  247 monitoring and new threat intelligence capabilities
• 10:33
  so they can hunt for threats instead of just
• 10:35
  reacting to them. That shift from reactive to
• 10:38
  proactive is key. But as you said, individual
• 10:41
  listeners also have to take action, especially
• 10:43
  if their data might be out there. Absolutely.
• 10:45
  The direct advice here is non -negotiable. First,
• 10:48
  change your passwords immediately. And we need
• 10:50
  to move past the eight -character minimum. Aim
• 10:54
  for 15 or more, a mix of letters, numbers, and
• 10:56
  symbols. And please, do not reuse passwords across
• 10:59
  different accounts. Basic password hygiene. What's
• 11:01
  number two? Multi -factor authentication. MFA.
• 11:04
  Set it up everywhere you can. Your email, your
• 11:06
  banking, your social media means an attacker
• 11:08
  needs both your password and your phone. It just
• 11:10
  makes it so much harder for them. And for anyone
• 11:12
  who is directly affected by the WSU breach, there
• 11:15
  are still specialized resources to help. That's
• 11:18
  right. WSU is still engaged with ID Care, which
• 11:21
  is Australia's national identity and cyber support
• 11:23
  service. If you need help, you can contact them
• 11:26
  with the referral code WSUDB25. The university
• 11:29
  also kept a dedicated phone line open, which
• 11:32
  is 02 -917 -46942. This whole saga from 2025
• 11:38
  really demonstrates that cybersecurity has to
• 11:41
  be treated as... well, maybe the single most
• 11:43
  critical institutional risk. The attackers, whether
• 11:46
  it's Riasis groups like Kilsek and Fogg or someone
• 11:49
  else, are persistent, professional, and they're
• 11:52
  exploiting these complex supply chains. The WSU
• 11:54
  incident just makes it crystal clear. Securing
• 11:57
  your supply chain, those third and fourth party
• 11:59
  vendors, it's not a compliance checkbox anymore.
• 12:01
  It's the primary way these advanced attacks are
• 12:03
  happening. If you can't vet your vendors, your
• 12:05
  whole system is compromised. The scale of it
• 12:08
  all suggests a fundamental reckoning is underway
• 12:10
  for the whole sector. I think so. The question
• 12:12
  for Australian universities is no longer if they'll
• 12:14
  be attacked. It's whether they have the sustained
• 12:16
  financial commitment, the sophisticated governance,
• 12:18
  the actual resources to defend against these
• 12:21
  evolving threats for the long haul. That's a
• 12:23
  powerful point to end on. It's about sustained
• 12:25
  commitment, not just crisis response. And if
• 12:28
  this discussion has raised concerns for you about
• 12:30
  your own organization's vulnerabilities or its
• 12:33
  third -party risk management, we'd encourage
• 12:35
  you to take that next step. You can go to www
• 12:37
  .kinsoft .com .au to discuss your security and
• 12:41
  IT needs with a team that understands this landscape.
• 12:44
  Thank you for joining us for Tech Talks with
• 12:46
  Kinsoft. We'll be back soon with another exploration
• 12:48
  into the world of technology and security.