Latest / Tech Talks With Kinsoft / Unpacking the January 2026 Prosura Data Breach

Transcript

Unpacking the January 2026 Prosura Data Breach · Tech Talks With Kinsoft

0:00
Hello and welcome to Tech Talks with Kinsoft.
0:02
Great to be here. Yeah, it's late February 2026
0:07
and I think it's safe to say the year has kicked
0:10
off with just a massive deafening wake up call
0:15
for Australian data security. Oh, absolutely.
0:17
It really has. Like if you were one of those
0:19
optimistic people who thought, hey. You know,
0:22
maybe things will cry it down after the chaos
0:24
of the last few years. Well, the first eight
0:27
weeks of 2026 have effectively looked at that
0:29
optimism and said. Absolutely not. It really
0:32
has been a relentless start to the year. I mean,
0:35
I've been staring at the reports on my desk all
0:37
week, and the sheer volume is overwhelming. It's
0:41
nuts. We aren't just seeing more attacks. We're
0:43
seeing a shift in tactics, a shift in targets,
0:45
and frankly, a shift in the level of aggression
0:48
from threat actors. Yeah. It just feels different
0:51
this time. It definitely feels personal, and
0:53
that is exactly what we're going to unpack for
0:55
you today. Our mission on this show is simple.
0:58
We take a huge stack of recent sources. So we're
1:00
talking news reports, company statements, forum
1:03
discussions, breach notifications. A whole lot.
1:06
Exactly. And we extract the critical nuggets
1:08
of knowledge for you. We aren't just reading
1:10
headlines. We are really doing a deep dive into
1:13
what this means for your data, your business,
1:15
and honestly, your sanity. And for today's discussion,
1:19
we are focusing on a specific case study that
1:21
really... I think it really illustrates this
1:23
new reality, the Pursura data breach that came
1:27
to light in January. Right. Because on the surface,
1:30
it might sound like just another corporate press
1:32
release, you know, an insurer gets hit, data
1:34
gets taken. But the specific details of how these
1:37
attackers behaved are crucial. It is a wild story.
1:40
But we aren't stopping there. We're going to
1:42
broaden the scope and look at how Prosura fits
1:45
into this chaotic start to 2026. Yeah, including
1:48
that massive UX fintech breach that just broke.
1:51
Exactly. We are asking the big question here.
1:54
What does this mean for anyone trusting companies
1:56
with their ID? It's a heavy topic, but an important
1:59
one. So let's get right into it. First up, let's
2:03
establish the facts regarding Prosura. Okay.
2:05
Who are they? I feel like a lot of people might
2:09
not recognize the name immediately. That's a
2:11
very fair point. Prosura is an Australian financial
2:14
services company. They specialize in rental vehicle
2:18
excess insurance. Right. You might actually know
2:21
them better by their trading name, which is Hiccup.
2:23
Right, Hiccup. But here's where it gets really
2:26
tricky for the average consumer. Prosura is a
2:29
key partner for the comparison site Vroom Vroom
2:32
Vroom. Exactly. And that right there is your
2:35
first big lesson in supply chain complexity.
2:38
Yeah. A lot of people who booked rental cars
2:41
through Vroom Vroom Vroom ended up having their
2:43
data sitting with Pursura. Even if they didn't
2:45
know it. Even if they didn't realize they were
2:47
dealing with Pursura directly at all. You book
2:49
on one site, but your data lives on another.
2:51
So unauthorized access was confirmed. Walk us
2:54
through the timeline here. How did this actually
2:56
go down? Well, it happened right as everyone
2:58
was recovering from New Year's Eve. Prasura detected
3:01
unauthorized access to their IT systems on January
3:04
3rd. And to their credit regarding containment,
3:08
they moved fast. They took their policy purchase
3:12
portals and their claims management systems offline
3:14
immediately to stop the bleeding. But then we
3:17
get into the numbers game. And looking at these
3:19
reports, this is where it gets incredibly confusing
3:22
for people. Because security researchers estimated
3:24
about 300 ,000 individuals were affected. Which
3:29
is a substantial number. It is. But then the
3:32
attackers went on to a data leak forum and claimed
3:35
they had... Get this, 98 million lines of records.
3:38
Right. 98 million sounds absolutely catastrophic.
3:41
It does, and it's designed to sound exactly that
3:43
way. But we have to be very careful with what
3:45
I like to call hacker math. Hacker math. I love
3:48
that term. Explain that for us. So that 98 million
3:51
figure likely refers to raw database rows. We
3:54
are talking about server logs, transaction history
3:57
entries, system events. Okay, so not individual
3:59
people. Exactly. Think about it this way. If
4:02
you are a customer, you might have one entry
4:05
for your name. another for your policy start
4:07
date another for a payment log another for a
4:11
change of address right so one single person
4:14
could generate hundreds of lines of data i see
4:17
so 98 million lines does not equal 98 million
4:20
people precisely it's marketing spin threat actors
4:24
inflate these numbers to increase pressure on
4:26
the victim company To scare them. To scare them
4:29
and to make the data look way more valuable to
4:32
other criminals on the dark web. They are trying
4:34
to sell a product after all. That makes sense.
4:37
However, I do want to be clear. For the 300 ,000
4:40
people who were actually affected, that distinction
4:42
doesn't make it any less painful. No, absolutely
4:45
not. And speaking of painful, let's talk about
4:47
the tactics. Because this wasn't just a steal
4:49
the data and run situation. No, it wasn't. This
4:52
is where the story gets chilling and, frankly,
4:54
where it deviates from the standard script we're
4:56
used to seeing. This is the part that really
4:58
stands out in the 2026 landscape. The threat
5:01
actors didn't just exfiltrate the database. They
5:04
used the stolen email addresses to contact the
5:06
victims directly. I saw this. We pulled a Geekzone
5:10
forum thread for this deep dive. And there was
5:13
a user, Kiwi Harry, who shared the actual email
5:17
they received from the hackers. Yes. And it wasn't
5:20
your standard phishing email full of bad grammar
5:22
and typos. It was surprisingly coherent. It was
5:26
incredibly manipulative. The hackers claimed
5:29
that they had originally tried to contact Prasura
5:31
to patch this issue and claim a bug bounty. Just
5:34
to clarify for the listener, a bug bounty is
5:36
usually a legitimate program, right? Where ethical
5:38
hackers get paid for... Finding security holes?
5:41
Correct. That's a standard industry practice.
5:43
But these guys were framing themselves as helpful
5:46
researchers who were simply ignored by the company.
5:49
Right. They claimed Pursura wouldn't listen,
5:51
so they were essentially forced to go public
5:52
to the customers. Right. I actually have the
5:54
quote right here from that email. They wrote,
5:56
Your trust has already been broken. The company
5:59
failed to act even after being warned. They basically
6:02
tried to turn the customers into a weapon against
6:05
the company's own HR team. It's pure psychological
6:08
warfare. By framing themselves as frustrated
6:11
bug bounty hunters who were forced to leak the
6:14
data, they try to shift the moral blame entirely
6:16
onto the victim company. That's insidious. It
6:20
is. They urge customers to pressure Prozora.
6:23
It creates mass panic, which puts immediate leverage
6:26
on the victim organization to pay up or negotiate.
6:30
And the user, Kiwi Harry, noted that the email
6:32
contained accurate policy numbers, dates, and
6:35
even links to view invoice that actually matched
6:37
the real URLs. Yes. It looked terrifyingly legitimate.
6:41
That is the kicker, even though it came from
6:43
a ProtonMail address. Which is encrypted, right?
6:45
Yeah, an encrypted email service often used by
6:47
privacy advocates, but heavily used by criminals,
6:50
too. But the inclusion of that specific, accurate
6:53
data makes it very hard for a layperson to just
6:56
dismiss it as spam. Right. It proves they have
6:58
the goods. Exactly. So they have the goods. What
7:00
exactly did they get? Because Presura came out
7:02
fairly quickly and said no credit card data was
7:05
accessed. That is correct. Presura doesn't store
7:08
credit card details on their end, so payment
7:10
information was technically safe. However, what
7:13
they did lose is arguably just as dangerous in
7:16
the long run. We are looking at names, emails,
7:19
phone numbers, travel destinations, and policy
7:21
dates. But there's a sensitive tier here too,
7:24
right? This is the part that really worries me.
7:26
Unfortunately, yes. For customers who had actually
7:29
filed a claim. So if you had an accident in your
7:31
rental car. Exactly. If you filed a claim. The
7:34
breach included driver's licenses and images
7:37
related to that team. Driver's licenses. I feel
7:39
like we often gloss over that when we hear about
7:41
breaches, but that is the absolute golden ticket
7:45
for identity theft. It is extremely high value
7:48
data. Think about it. A credit card gets stolen.
7:51
It can be canceled and replaced in 24 hours.
7:54
Right. The bank reverses the charges. You get
7:56
a new card. Your life goes on. Exactly. But a
7:58
driver's license, that is a primary identity
8:01
document. Yeah. It is used for know your customer
8:04
or KYC checks at banks. It's used for setting
8:08
up phone contracts, for applying for personal
8:10
loans. So if a criminal has a high res scan.
8:13
of my license. They can bypass a huge amount
8:16
of security filters at other institutions. They
8:18
essentially become you. Wow. And unlike a credit
8:20
card, you can't just cancel your date of birth
8:22
or your license number easily. That data sticks
8:25
with you. That explains the massive operational
8:28
impact, too, because Prozura had to shut down
8:31
new sales and their self -service portal for
8:34
weeks. I don't think they posted a restoration
8:37
update until mid -January. That is a significant
8:39
business disruption. Massive. You're talking
8:42
about weeks of zero revenue from new sales combined
8:45
with a reputational hit. It shows that even if
8:48
you don't lose credit card data, the operational
8:50
cost of a breach like this is immense. And the
8:53
scary thing is, ProZero wasn't the only one having
8:55
a bad start to the year. This feels like it's
8:57
part of a much bigger wave. It certainly is.
9:00
If we pivot to the broader landscape, 2026 is
9:03
rapidly shaping up to be the year of the breach
9:05
in Australia. Because just a few weeks after
9:08
the Presura news kind of settled down, we got
9:11
hit with the UX breach in February. Tell us about
9:14
that one. UX is a fintech company, right? Correct.
9:17
A Sydney -based fintech. And this one was arguably
9:20
worse in terms of pure volume. They exposed the
9:24
personal and financial details of 444 ,538 Australian
9:30
borrowers. Nearly half a million people. Yes.
9:33
And looking at the technical notes we have here,
9:35
the cause was entirely different, too. Brazura
9:38
was unauthorized access, an active hack. What
9:42
happened to UX? UX appears to be a case of severe
9:45
misconfiguration. It wasn't necessarily a sophisticated
9:48
break -in where some hacker cracked an encrypted
9:50
code. Okay. It was an unsecured database, specifically
9:54
a MongoDB Atlas cluster. Right. And it was left
9:57
open and accessible to the public internet for
9:59
at least 10 months. 10 months. 10 months. That
10:02
is an eternity in cyber time. And just so we're
10:04
completely clear for the listener, when you say
10:06
unsecured MongoDB cluster... what are we actually
10:08
picturing here imagine leaving a giant filing
10:11
cabinet full of loan applications on the sidewalk
10:13
outside your office unlocked 24 7. anyone walking
10:18
past who knows what a filing cabinet looks like
10:20
can just pull open a drawer and take whatever
10:22
they want wow that is effectively what happened
10:24
on the internet it requires zero hacking skills
10:27
to access if you just know where to look and
10:29
the data hall was massive huge 141 gigabytes
10:33
good grief containing loan applications residential
10:36
addresses and again those highly valuable driver's
10:39
licenses and it affected borrowers across a hundred
10:42
different lenders because ux acts as an intermediary
10:45
so again we have that supply chain issue Exactly.
10:48
You might not even know who UX is, but your lender
10:50
used them and now your data is gone. So we have
10:53
a hack at an insurer and a wide open door to
10:56
fintech. But looking at the list of incidents
10:59
from January and February 2026, it really seems
11:02
like no sector is safe right now. It is completely
11:04
indiscriminate. Look at January. The Victorian
11:07
Department of Education confirmed a breach impacting
11:09
1 ,700 government schools. Wow. Then you have
11:12
Regis Resources, which is a major gold producer,
11:15
confirming a cyber attack. Gold mines in schools.
11:19
You seriously couldn't pick two more different
11:21
industries. Right. And let's not forget hospitality.
11:25
Oh, yeah. Seagrass. Seagrass Boutique Hospitality
11:27
Group was claimed by the Cairo's ransomware gang
11:30
in February. And then the Aeromedical Society
11:32
of Australasia was hit by lock bit. That is just
11:36
a terrifying mix. Emergency medical services,
11:39
restaurants, mining, education. So when you look
11:43
at all these reports on your desk, what patterns
11:45
are actually emerging? What is the trend for
11:47
2026? There are two main trends emerging from
11:50
this chaos. The first is a major shift in the
11:53
endgame. What do you mean by endgame? Well...
11:56
We used to see a lot of encryption -only ransomware.
11:59
Right. Where they just lock your computers, encrypt
12:01
your files, and demand money to give you the
12:03
decryption key. Yeah, the classic ransomware
12:05
model. Exactly. But now we're seeing a massive
12:08
shift toward data theft and extortion. So it's
12:11
less about give us money to get your service
12:12
back and more about give us money or we tell
12:15
everyone your secrets. Precisely. It is what
12:17
we call double extortion or sometimes extortion
12:19
only. The Prasura case is a prime example of
12:22
this. Right. They stole the data and immediately
12:25
started leveraging the customers to force a payout.
12:28
They don't even need to encrypt your network
12:30
if they can cause enough panic among your user
12:32
base. It makes total sense because companies
12:35
have gotten so much better at backups over the
12:37
last five years. So locking the computers isn't
12:40
quite as scary as it used to be. Exactly. You
12:42
just restore from a backup. But leaking the data.
12:45
You can't undo that with a backup. No. Once the
12:48
toothpaste is out of the tube, you cannot put
12:50
it back. And the second big trend. Supply chain
12:54
risk. We've touched on that a bit. Yeah, we saw
12:56
it with Pursura affecting the Vroom Vroom customers.
12:59
We saw it with UXitat affecting borrowers across
13:02
100 different lenders. You might really trust
13:05
the company you are buying from, but do you trust
13:08
the third -party insurer they use? Or the fintech
13:11
platform processing the loan in the background.
13:14
Exactly. That is the really scary part for consumers.
13:17
You can have great personal security, but if
13:19
your partner leaves the back door open, you are
13:22
still in trouble. Which brings us to the big
13:24
takeaway for our listeners. Why does this keep
13:27
happening? Is the technology failing or are we
13:30
failing the technology? Yeah, let's get technical
13:32
for a second. What are the actual failing points
13:34
inside these organizations? Based on the deep
13:37
dive into these reports, it essentially comes
13:39
down to two somewhat boring but absolutely critical
13:42
concepts, identity and access management or IAM
13:45
and data segregation. Okay, let's unpack those.
13:48
Start with IAM. Right. So in the Pursura case,
13:50
it was unauthorized access. That usually implies
13:53
weak access controls. Like bad passwords? Yeah,
13:56
maybe single -factor authentication or credentials
13:59
that were stolen somewhere else and reused. If
14:02
you have strong IAM, like mandatory multi -factor
14:05
authentication, strictly limiting who can log
14:08
in from where, it's so much harder for an attacker
14:11
to just walk in the front door. And data segregation,
14:13
that sounds like what? Putting things in different
14:15
boxes? That is exactly what it is, about limiting
14:18
the blast radius of a breach. Blast radius, right.
14:21
If an attacker gets into your front -end web
14:23
portal, should they be able to automatically
14:25
access the entire back -end database of driver's
14:28
license images? Definitely not. Ideally, no.
14:32
Those images should be segmented, highly encrypted,
14:35
and kept in a completely separate, highly secure
14:37
zone. Which didn't happen with UX. Right. In
14:40
the UX case, leaving a massive MongoDB cluster
14:43
open to the internet suggests a total failure
14:46
of both segregation and configuration management.
14:49
Everything was just there, together. It sounds
14:52
like basic IT hygiene, but clearly it is being
14:56
missed at a very high level. It is often sacrificed
14:59
for speed or ease of access. Developers want
15:02
the data to be easy to query, to build apps faster.
15:05
But in 2026, the price of that convenience is
15:07
becoming unbearable. Let's talk about that price,
15:10
the aftermath. Yeah. Coursera responded by notifying
15:12
the ACSC, the Australian Cyber Security Center,
15:15
and the OAIC. But there was a bit of a dilemma
15:18
with their transparency, wasn't there? There
15:20
was. And this is a nightmare scenario for any
15:22
crisis communications team. Because Pursura eventually
15:25
set up an incident page and confirmed the breach,
15:28
but the attackers beat them to the punch. Exactly.
15:32
When the very first time your customer hears
15:34
about a breach is from the criminal who stole
15:37
their data, you have completely lost control
15:39
of the narrative. Yeah, you look terrible. It
15:41
causes immediate panic and severe reputational
15:44
damage. It makes the company look incompetent
15:46
or even worse, like they were actively trying
15:48
to hide the breach. Now, Prezura did warn customers,
15:52
eventually, telling them strictly not to engage
15:55
with the attackers or pay them any money. Which
15:58
is absolutely the correct advice. You should
16:00
never, ever negotiate with individual hackers
16:04
as a consumer. But by the time they sent that,
16:06
the fear was already sown. And the cost for the
16:09
company isn't just reputational anymore. You
16:11
mentioned earlier that the legal costs are rising,
16:14
too. It is not just a slap on the wrist. That's
16:16
right. We really have to look at the regulatory
16:18
context here. In February 2026, right as all
16:21
these breaches were unfolding, FIIG Securities
16:24
was fined $2 .5 million by the federal court.
16:28
$2 .5 million? Yes. For cybersecurity failures
16:32
related to a breach from a few years prior. That
16:35
is a very serious number. It sets a massive precedent.
16:38
The courts and regulators are clearly saying
16:40
that cybersecurity is not just an IT problem
16:42
anymore. It is a strict legal obligation for
16:46
license holders. If you fail to protect client
16:48
data, you will pay for it. Literally. So companies
16:52
are getting squeezed from both sides right now.
16:54
The hackers are demanding ransoms on one side
16:57
and the regulators are demanding fines on the
16:59
other. It's a total pincer movement. And caught
17:01
right in the middle are the customers wondering
17:03
where their driver's license scam has ended up
17:05
on the dark web. It's really sobering reality.
17:08
So looking back at the Pursura incident and this
17:11
whole chaotic start to 2026, what is the big
17:15
takeaway here for you? I think the Persora breach
17:17
is a perfect case study for the modern threat
17:21
landscape. Yeah. It shows us that attackers are
17:24
becoming much more aggressive. They will contact
17:25
your customers directly. It shows us that non
17:28
-financial data like driver's licenses is extremely
17:31
valuable currency for identity theft. And it
17:34
serves as a stark reminder that our digital supply
17:37
chains are incredibly fragile. It really does
17:41
feel like the rules of engagement have just permanently
17:43
changed. They have. And I have a final thought
17:45
for you to mull over. Let's hear it. We are seeing
17:47
attackers effectively weaponize customer service.
17:51
Weaponize it. Yes. By emailing the customers
17:54
directly, they're trying to create a massive
17:57
denial of service attack on the company's own
17:59
support lines and HR teams. Oh, wow. It's fueled
18:02
entirely by panic. So if customer panic is now
18:06
becoming a primary weapon for cyber criminals,
18:08
how do organizations defend against that? It
18:11
is not just a firewall problem anymore. It's
18:13
a psychological one. That is a terrifying thought.
18:16
Because how do you patch human panic? You can't.
18:18
That's something we definitely all need to consider.
18:21
Security really isn't just about code anymore.
18:23
It's about communication and it's about trust.
18:25
Absolutely. Well, that brings us to the end of
18:27
our deep dive today. I want to thank you all
18:29
for joining us on Tech Talks with Kinsoft. Thanks
18:32
for listening, everyone. And listen, if today's
18:34
discussion has raised any questions about your
18:35
own organization's resilience, whether it's your
18:38
access management, your data segregation or just
18:41
your readiness for an incident like this, we
18:43
strongly suggest you head over to www .kinsoft
18:47
.com .au. That's www .kinsoft .com .au. Go there
18:52
to discuss your security and IT needs before
18:54
you end up as our next case study. Great advice.
18:57
Until next time, stay secure out there.