Latest / Tech Talks With Kinsoft / Legal Practice Board of Western Australia Data Breach

Transcript

Legal Practice Board of Western Australia Data Breach · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. Today we're
• 0:02
  unraveling a topic that's really become non -negotiable
• 0:05
  for pretty much every professional out there,
• 0:07
  cybersecurity. The online world is buzzing, definitely,
• 0:10
  but unfortunately that also means, you know,
• 0:13
  a big jump in cybercrime. We're going to explore
• 0:15
  what these threats mean for you specifically
• 0:17
  using a pretty significant real -world case study.
• 0:20
  Our goal is to cut through the noise, really,
• 0:23
  and give you the essential insights so you can
• 0:25
  be informed and prepared. Yeah. And what's really
• 0:28
  striking is just how fast these threats change.
• 0:31
  Right. They're always shifting, looking for new
• 0:33
  online opportunities. We'll connect that to how
• 0:35
  businesses, especially professional services
• 0:37
  like, say, law practices are affected and what
• 0:41
  measures actually seem to work. Exactly. We'll
• 0:44
  look closely at a recent very public cyber incident
• 0:47
  in the legal sector. We'll get into the nitty
• 0:49
  gritty of what went down and then importantly,
• 0:52
  pivot to why having the right kind of cyber insurance
• 0:55
  is. Well, it's not really optional anymore. So
• 0:58
  let's start with the bigger picture. We're seeing
• 1:01
  this clear trend. Cybercrime is definitely rising,
• 1:04
  especially here in Australia. Criminals are getting
• 1:06
  smarter, focusing online, and it's causing, you
• 1:09
  know, major disruption, real losses. It's much
• 1:13
  more than just a small hassle. And that brings
• 1:15
  up a really important point. What do these losses
• 1:17
  actually look like for a practice? It's not just
• 1:20
  the obvious stuff. I mean, sure, there are the
• 1:22
  immediate costs, investigation, IT fixes to get
• 1:24
  systems back up, rebuilding from backups, finding
• 1:27
  the vulnerability, all that. But then there are
• 1:29
  these huge first -party losses. That's things
• 1:32
  like lost income because you can't operate, extra
• 1:34
  expenses just to keep things afloat during the
• 1:36
  interruption. These costs, the ones the business
• 1:39
  itself suffers, they're often overlooked, but
• 1:41
  honestly, they can be devastating. Resilience.
• 1:44
  is key. Right. And to really see what this looks
• 1:46
  like in practice, let's dive into a specific
• 1:48
  case, a very public one involving the Legal Practice
• 1:51
  Board of Western Australia, the LPBWA. They had
• 1:55
  a major cyber incident. And it turned out to
• 1:57
  be a group calling themselves Direwolf. Direwolf.
• 2:00
  Yeah, they're relatively new, but pretty aggressive.
• 2:03
  They actually state their motive is just money.
• 2:06
  They say no morals, no political stance, no LGBT.
• 2:10
  And they use these double extortion techniques.
• 2:12
  Double extortion. What does that mean exactly?
• 2:14
  Well, it means they don't just lock up your data
• 2:16
  with ransomware and demand money to unlock it.
• 2:19
  They also steal a copy of your data before they
• 2:22
  encrypt it. Then they threaten to publish that
• 2:24
  stolen data online if you don't pay up. Wow.
• 2:27
  So they hit you twice, operationally and reputationally.
• 2:30
  Exactly. It massively increases the pressure,
• 2:32
  especially for businesses that handle sensitive
• 2:34
  client information. I think law firms, accountants,
• 2:37
  the reputational damage can be huge. Okay. So
• 2:40
  let's unpack the LPBWA incident itself. How did
• 2:43
  it unfold? Well, they detected unusual activity
• 2:46
  on their network. That was on Wednesday, May
• 2:49
  21st, 2025. That discovery led them to, you know,
• 2:53
  act fast. They took some systems offline right
• 2:55
  away, including their main website services,
• 2:58
  basically to contain the problem. And what happened
• 3:01
  right after that? How did they keep operating?
• 3:03
  They had to switch to manual workarounds. Think
• 3:06
  about that. Processing applications, renewals
• 3:08
  for practicing certificates all by hand or through
• 3:11
  less efficient methods. That must have been incredibly
• 3:13
  disruptive for the practitioners relying on that.
• 3:16
  Absolutely. It shows the immediate real world
• 3:18
  impact on just day to day operations, slows everything
• 3:22
  down. Then things escalated. They found out some
• 3:25
  information had actually been disclosed publicly.
• 3:27
  That was Tuesday, May 27th. What kind of data
• 3:31
  are we talking about? What got out? Their investigation
• 3:33
  confirmed it was limited corporate correspondence.
• 3:36
  It had some minimal contact information, a bit
• 3:39
  of operational and resourcing information, and
• 3:41
  crucially, banking information for the board
• 3:43
  itself. And a very small number of third parties.
• 3:47
  Those third parties were notified directly, of
• 3:50
  course. Okay. Minimal contact info, some operational
• 3:53
  stuff, some banking details. Right. And importantly,
• 3:56
  they confirmed that sensitive personal data like...
• 3:59
  trust information or residential addresses was
• 4:03
  not part of that disclosure. That was a key finding,
• 4:05
  thankfully. But the attackers, Direwolf, they
• 4:08
  made some big claims, didn't they? Oh, yeah.
• 4:10
  They claimed they'd stolen a massive 300 gigabytes
• 4:13
  of data. Classic tactic to scare the victim.
• 4:16
  They even published a timeline threatening to
• 4:19
  release samples, then half the files, then the
• 4:21
  rest over the next month or so. 300 gigs. That
• 4:24
  sounds absolutely terrifying. It does. And the
• 4:26
  threat was real. designed to maximize pressure.
• 4:29
  But, and this is important, the LPBWA kept monitoring
• 4:33
  very closely. On June 19, someone did post a
• 4:36
  link supposedly containing data, but the LPBWA
• 4:39
  reviewed it immediately and confirmed that specific
• 4:42
  data does not relate to the board. So the attackers
• 4:44
  might have been bluffing or exaggerating the
• 4:46
  scope. So verifying the attackers' claims is
• 4:49
  crucial. Don't just take their word for it. Exactly.
• 4:51
  And they haven't detected any further related
• 4:53
  activity since then. It shows the importance
• 4:56
  of that verification step. What steps did the
• 4:59
  LPBWA take in response, beyond the technical
• 5:02
  side? They brought in external experts, worked
• 5:05
  closely with Cybersecurity Western Australia,
• 5:07
  and they took a significant legal step, too.
• 5:11
  They obtained an injunction. An injunction. What
• 5:14
  does that actually achieve in this context? Well,
• 5:16
  it's a court order. It legally prohibits anyone
• 5:19
  from accessing, sharing, or using the impacted
• 5:22
  data. So if someone tries to publish it or trade
• 5:24
  it, they're breaking the law. It adds a serious
• 5:27
  legal weapon to their recovery efforts. Interesting.
• 5:30
  And what about the direct impact on the legal
• 5:32
  practitioners themselves? Well, besides the manual
• 5:35
  forms we mentioned, the Find a Practitioner online
• 5:37
  search tool was down for a while. That was inconvenient
• 5:40
  for the public and other lawyers. And they waived
• 5:42
  late fees for a bit. Yeah, for the June renewals,
• 5:45
  they waived the late fees because of all the
• 5:46
  disruption. But those fees came back on July
• 5:49
  1st. OK, so this whole LPBWA case study, it really
• 5:53
  drives home how vulnerable organizations can
• 5:55
  be, right? Even statutory bodies. Absolutely.
• 5:58
  Even organizations you'd think would have robust
• 6:01
  security. It leads us straight into the critical
• 6:04
  need for protection and specifically cyber insurance.
• 6:08
  Right. So thinking about legal practices again,
• 6:11
  how does this fit with their standard insurance?
• 6:13
  Like a professional indemnity policy, say, from
• 6:16
  the LPLC. That's a great question, and there's
• 6:19
  often confusion here. A standard PI policy, like
• 6:22
  the LPLCs, does cover certain things. It covers
• 6:25
  your civil liability related to your legal practice.
• 6:28
  So if a third party, like a client, sues you
• 6:31
  for damages because their data was breached due
• 6:33
  to your firm's mistake, that kind of claim usually
• 6:36
  falls under the PI policy. Okay, so third party
• 6:38
  claims like a client suing you. Exactly. But
• 6:41
  here's the really crucial part, that PI policy
• 6:44
  generally... does not cover the firm's own business
• 6:47
  losses, those first -party losses we talked about
• 6:49
  earlier. Ah, okay. So it wouldn't cover things
• 6:51
  like? Like the cost of the business being interrupted,
• 6:53
  the income you lose while you're down, or the
• 6:55
  cost of retrieving your data, the IT forensics,
• 6:58
  rebuilding your systems, maybe even regulatory
• 6:59
  fines. All those costs fall directly on the firm
• 7:02
  itself. And those costs can be huge. as we saw
• 7:06
  with the LPBWA needing experts and workarounds.
• 7:09
  Astronomical, potentially. Imagine being shut
• 7:11
  down for weeks. Your PI policy might handle the
• 7:14
  client lawsuit, but it won't pay for getting
• 7:16
  your own business back up and running or the
• 7:18
  income lost during that time. That's a massive
• 7:21
  financial gap. Which explains why we're seeing
• 7:23
  more firms getting separate cyber insurance,
• 7:26
  right, to fill that gap. Precisely. It's becoming
• 7:28
  standard procedure now. Firms are buying cyber
• 7:31
  insurance cover to supplement their other insurances.
• 7:34
  In fact, the LPLC recognized this gap was so
• 7:37
  significant, they actually worked with insurers
• 7:39
  Marsh and Chubb to create an optional commercial
• 7:41
  cyber policy. It's designed specifically to sit
• 7:45
  alongside the PI cover and handle those first
• 7:47
  party losses. That really says something about
• 7:49
  how essential this type of cover has become.
• 7:52
  It really does. It underlines that strong cybersecurity
• 7:55
  isn't just about firewalls and software updates.
• 7:58
  It's also about financial resilience. The threats
• 8:00
  are always changing, sophisticated scams, accidental
• 8:03
  data leaks, even new risks from things like AI
• 8:06
  being used in practices. Cyber insurance provides
• 8:09
  that vital safety net for your costs, the first
• 8:13
  party risks that your PI policy just isn't designed
• 8:15
  to cover. OK, so given everything we've discussed,
• 8:18
  the rising threats, the dire wolf example, the
• 8:20
  insurance gaps. What practical steps can people
• 8:23
  listening take now to protect themselves and
• 8:25
  their organizations? Right. Let's get practical.
• 8:28
  For your organization, it starts with a proactive.
• 8:31
  multi -layered defense that's more than just
• 8:34
  antivirus software. It means having robust security
• 8:36
  frameworks, regular vulnerability testing, like
• 8:39
  penetration testing, to find weaknesses before
• 8:41
  the bad guys do. And crucially, having a well
• 8:44
  -thought -out, tested incident response plan.
• 8:46
  What do you actually do when something happens?
• 8:48
  Who do you call? How do you communicate? It's
• 8:50
  like a fire drill, but for cyber incidents. And
• 8:52
  training for staff must be key, too. Absolutely
• 8:55
  critical. Regular, engaging training on spotting
• 8:59
  phishing emails, understanding social engineering
• 9:01
  tactics, because often the human element is the
• 9:05
  easiest way in for attackers. Okay, that's the
• 9:07
  organization. What about on a personal level,
• 9:10
  especially if you're worried your details might
• 9:11
  have been exposed somewhere? Yeah, good point.
• 9:14
  Even if it's just minimal contact information
• 9:16
  or banking details, extra vigilance is essential.
• 9:19
  Ask yourself. Are you really checking your bank
• 9:22
  account statements and transaction histories
• 9:24
  regularly for anything suspicious? That's your
• 9:27
  first line of defense. And if you see something
• 9:29
  weird? Contact your bank directly. Use the official
• 9:32
  phone number from their website or the back of
• 9:34
  your card. Never, ever click a link in an email
• 9:36
  or text message purporting to be from them. Good
• 9:39
  advice. What else? Use two -step authentication
• 9:41
  or multi -factor authentication wherever you
• 9:43
  possibly can, especially for important accounts
• 9:45
  like email and banking. Consider hardware tokens
• 9:48
  if possible. Also, check your credit report at
• 9:52
  least once a year. It can alert you if someone's
• 9:54
  trying to open accounts in your name. And the
• 9:56
  email advice bears repeating. Never click links
• 10:00
  or open attachments in suspicious emails. Just
• 10:03
  delete them or call the supposed sender directly
• 10:05
  to verify. Exactly. It's always safer to verify
• 10:08
  independently. So the reality is these risks
• 10:10
  aren't going away. They're constantly changing
• 10:12
  shape. That's right. It's not a one and done
• 10:15
  fix. It's a continuous process of assessment,
• 10:17
  adaptation and vigilance, both at work and at
• 10:20
  home. You know, considering how fast and clever
• 10:23
  these criminals are getting online, it's worth
• 10:25
  asking yourself. How prepared are you, really,
• 10:28
  for a digital incident? And what steps can we
• 10:31
  all take, maybe starting today, to build a culture
• 10:33
  where thinking about mitigating cyber risks is
• 10:36
  just second nature, like locking your door at
• 10:38
  night? That's a powerful thought to end on. We
• 10:40
  really hope this exploration of the recent cyber
• 10:43
  incidents and the role of cyber insurance has
• 10:45
  given you some valuable insights and some concrete
• 10:48
  takeaways. Understanding these threats and knowing
• 10:50
  how to prepare and respond is just so crucial
• 10:53
  now. And knowledge is great, but it's most valuable
• 10:56
  when you actually understand it and apply it.
• 10:57
  So stay vigilant. Stay informed. And remember,
• 11:00
  it's a constantly evolving landscape. There's
• 11:02
  always more to learn. Absolutely. For more information
• 11:05
  on securing your own digital environment or to
• 11:08
  discuss your specific security and IT needs,
• 11:10
  you can head over to www .kinsoft .com .au. That's
• 11:15
  www .kinsoft .com .au. Thank you for joining
• 11:19
  us on Tech Talks with Kinsoft. We look forward
• 11:21
  to sharing more insights with you next time.