Latest / Tech Talks With Kinsoft / IINET Data Breach august 2025

Transcript

IINET Data Breach august 2025 · Tech Talks With Kinsoft

0:00
Hello and welcome to Tech Talks with Ken Soft.
0:02
I'm your host and I'm really glad you could join
0:04
us in the space where we stop just, you know,
0:06
reading the headlines. And start to actually
0:08
unpack them. Exactly. We turn all that complex,
0:11
sometimes chaotic tech news into usable knowledge
0:15
for you. It's great to be here. And honestly,
0:17
chaotic is probably the perfect word for what
0:19
we're tackling today. Absolutely. Today, we're
0:22
doing a bit of a retrospective, looking back
0:23
at a major event from back in August 2025. We're
0:27
talking about the massive data breach at the
0:29
Australian ISP, INET. That's right. And I can
0:33
just hear people asking, you know. Why look back
0:36
at something from August 2025? It's January 2026
0:39
now. Right. Why drag this one up? Well, it's
0:41
all about context. This breach is just a perfect
0:43
textbook example of this modern paradox we see
0:46
in cybersecurity. You have all these incredibly
0:49
sophisticated threats. Sure. AI, state -sponsored
0:53
actors, all of it. The works. And yet the actual
0:55
point of failure here was remarkably, I mean,
0:58
almost painfully simple. It's that classic chain
1:01
is only as strong as its weakest link scenario,
1:04
isn't it? It really is. We're looking at how
1:07
the credentials of just one employee open the
1:10
door to hundreds of thousands of customer records.
1:13
It forces us to ask some pretty uncomfortable
1:16
questions. About how secure our data actually
1:18
is. Right. Even with these huge telcos. Exactly.
1:21
So our mission today is to peel back the layers
1:24
on this one. We're not just going to list what
1:26
was stolen. We're going to look at the anatomy
1:28
of the breach, the very specific and surprisingly
1:31
high risk nature of some of that data. Especially
1:34
the modem stuff. Oh, yeah. We've got some fascinating
1:37
research on that. And then we'll talk about what
1:38
this means for Australian businesses and, you
1:41
know, for you at home right now. Shall we get
1:43
into the numbers? Let's do it. So set the scene
1:45
for us. It's August 16th, 2025. INET, which is
1:50
owned by TPG Telecom, discovered something is
1:52
very wrong. Right. They identified an intrusion
1:55
into their order management system. Now, let's
1:58
pause there for a second. OK. When people hear
2:00
order management, they might think of like. a
2:03
list of invoices or a spreadsheet. Who ordered
2:06
a router, that kind of thing. Yeah. But in a
2:08
telco context, this is the nervous system of
2:10
the customer relationship. It's the system for
2:12
NBN connections, for new orders. It holds the
2:15
who, what, and where of the entire customer base.
2:18
So it's not the vault with the credit card keys,
2:20
but it's the front desk that knows everyone's
2:23
business. That's a perfect way to put it. And
2:25
the scale was, well, substantial. We're not talking
2:29
a handful of accounts. We're looking at approximately
2:31
280 ,000 active email addresses. A quarter of
2:36
a million people's primary communication channel.
2:38
Yes, gone. In one go. And it wasn't just emails.
2:41
About 20 ,000 active landline numbers were leaked.
2:44
And then there was this other batch, about 10
2:46
,000 records, that had a trifecta of data. Usernames,
2:50
street addresses, and phone numbers. And that
2:52
trifecta is dangerous. We'll definitely get to
2:54
why in a moment. But there was one detail that
2:56
really stood out, something that feels a bit
2:58
more invasive than just a phone number. You're
3:00
talking about modems? Yeah. Around 1 ,700 modem
3:03
setup passwords were accessed. That is such a
3:06
specific and, frankly, unsettling piece of data
3:10
to lose. Most of us just think of our modem as
3:13
that blinking box in the corner. But before we
3:16
dive into the nightmare scenarios for those 1
3:18
,700 people, the big question, how did they get
3:21
in? Was this an elite team of hackers, you know,
3:25
lasers and all that? I wish it were that cinematic.
3:28
It would make for a better movie. But the reality
3:31
is much more mundane. It looks like it was a
3:33
phishing attack. Phishing, the thing we've been
3:36
warned about since the 90s. Very same. The attackers
3:39
likely tricked a single employee into giving
3:41
up their login details. Once they had that one
3:43
key. That was it. They were in the order management
3:46
system. And this wasn't ransomware, right? They
3:48
weren't locking things up. No, not at all. This
3:50
was a quiet extraction. Which is almost creepier.
3:52
It's like someone breaking into your house not
3:54
to trash it, but just to photocopy your diary
3:56
and leave without you knowing. That's a great
3:58
analogy. They got in, grabbed the data, and got
4:01
out. And because it wasn't loud, you know, like
4:03
ransomware, the extraction could happen without
4:06
triggering all the usual chaos. Now, INET was
4:09
quick to say the system contained limited personal
4:12
information. They really stressed that, you know,
4:15
no driver's licenses, no passports, no credit
4:17
cards. That sounds good, right? Or is that just
4:20
corporate spin? Legally, it's better than losing
4:23
passports for sure. It saves them from certain
4:25
regulatory headaches. But we have to be so careful
4:29
with that word limited. Why is that? In cybersecurity,
4:32
limited data is often the building block for
4:35
total compromise. Just because they didn't get
4:38
your credit card number doesn't mean they can't
4:39
cause you financial harm. Because they can use
4:41
that limited info to trick you into giving up
4:43
the rest. Precisely. It creates the foundation
4:46
for identity fraud, for social engineering. It's
4:48
the mosaic effect. One piece of tile isn't a
4:52
picture. But if I have your email, your address,
4:54
your phone number. Suddenly, I have a very clear
4:57
picture of who you are. But let's circle back
5:00
to those modem passwords you mentioned, because
5:02
that is a risk vector people just don't think
5:04
about. Yeah, let's unpack this. 1 ,700 modem
5:07
passwords. I feel like most people get their
5:10
modem from the ISP. plug it in, use the default
5:13
password on the sticker, and just forget about
5:15
it. Why is that so dangerous? Well, if a hacker
5:18
has your modem password, they potentially control
5:20
your gateway to the internet. There was a great
5:23
analysis on this referencing a specific piece
5:25
of malware called The Moon. The Moon. Sounds
5:28
like a bad sci -fi movie. It acts like one, too.
5:30
It targets outdated or compromised routers and
5:33
turns them into, well, zombies. Okay, so define
5:36
zombie for me. What is my router actually doing?
5:39
It's not eating brains. No, but it is being remote
5:43
controlled. Your router still works for you,
5:44
you can still stream your shows, but it's also
5:46
working for them. It becomes part of a botnet.
5:49
There's a cybercriminal proxy service called
5:51
Faceless. Faceless? Seriously? Yes, really. And
5:55
they use these compromised routers to route illegal
5:57
traffic. So my home internet connection could
6:00
be used to hide the tracks of a criminal gang.
6:03
Yes. Criminals need clean IP addresses. If they
6:07
attack a bank from a known criminal server, they
6:10
get blocked instantly. But if that traffic looks
6:13
like it's coming from a nice family home in a
6:15
suburb somewhere. Just passes right through.
6:17
And if your modem password is out there, you
6:20
become a node in their network. You might not
6:22
even notice a slowdown, but your IP address,
6:25
your digital fingerprint, is effectively laundering
6:28
cybercrime. That is terrifying. That completely
6:31
changes the stakes from someone might read my
6:34
emails to the police might knock on my door.
6:37
Exactly. That's why those 1 ,700 passwords were
6:39
such a critical loss. It turns the victims into
6:41
unwitting accomplices. And it's not just the
6:44
hardware risks. We talked about social engineering.
6:47
When you combine an address, a phone number,
6:49
and the fact that you're an iNet customer, the
6:51
scams can get incredibly convincing. Oh, they
6:54
really can. And we saw this happen. There were
6:56
discussions on Reddit right after the breach.
6:57
One user posted about an SMS they got about NBN
7:01
planned maintenance. I remember this. It wasn't
7:03
a generic dear customer text, was it? No, and
7:06
that's the danger. The text mentioned their specific
7:09
suburb. I think it was Carlisle. It had accurate
7:12
dates. It looked completely legitimate. And it
7:15
arrived just days after the breach news broke.
7:17
So put yourself in their shoes. You know there's
7:21
been a breach. You're on edge. And then a text
7:24
comes through that gets your location right,
7:26
your provider right, and asks you to click a
7:27
link. Your brain just says, oh, this must be
7:30
real. That's the metadata bypassing our natural
7:33
skepticism. Exactly. That is why saying it's
7:36
limited personal information is so misleading.
7:38
That limited info is the fuel for these high
7:41
success rate scams. Speaking of trust, the customer
7:45
reaction wasn't exactly sympathetic, was it?
7:48
Checking the community pulse, it felt like there
7:50
was a lot more frustration there than just this
7:52
one incident. It was a tipping point. You have
7:55
to remember, Inet used to be the darling of the
7:57
Aussie tech scene. The gamers ISP, great local
8:00
support. Right. But longtime users were already
8:03
unhappy. There was a lot of anger about them
8:06
offloading their email services to a third party,
8:08
the messaging company. Oh, that's right. People
8:11
were suddenly being asked to pay for email addresses
8:13
they'd had for free for 20 years. Correct. It
8:16
was a messy migration. And the sentiment was
8:18
scathing. People were saying, I'm paying this
8:20
company to keep my data secure. And now it's
8:23
been leased anyway. There was this strong perception
8:26
that ever since TPG bought iNet, it's been a
8:29
strategy of value extraction. Value extraction.
8:32
That sounds like corporate speak for squeeze
8:34
it till it's dry. It's exactly that. The theory
8:37
that you buy a beloved brand, keep the name,
8:40
but you gut the costs on infrastructure, support,
8:43
and engineering to maximize profit. The feeling
8:46
was that support was gone, the tech was aging,
8:49
and security gaps were inevitable. The hollowed
8:51
out theory. You keep the paint fresh, but you
8:54
strip the engine. That's the perception. And
8:56
a breach like this, well, it confirms all those
8:59
fears for people. Now, INED did take legal action.
9:02
They got an interim injunction to stop anyone
9:05
from publishing the stolen data. That sounds
9:07
impressive. But does a hacker in Russia care
9:11
about an Australian court order? Not in the slightest.
9:13
An injunction like that, it stops legitimate
9:16
media from publishing. the raw data. It stops
9:19
a competitor from using it. But the bad actors
9:22
on the dark web are not checking the court registry
9:25
before they sell a database. Exactly. Once that
9:27
data is exfiltrated, it's out there. You can't
9:30
litigate it back into the bottle. It's like trying
9:32
to recall a rumor. So that brings us to the bigger
9:35
picture. This wasn't just happening to INET,
9:38
right? No, not at all. We need to zoom out. Around
9:41
the same time, the UK telco cult was hit by a
9:44
ransomware gang. And here in Australia, we've
9:47
seen TPC, Telstra, Tangerine, all of them hit
9:51
by these kinds of credential based breaches.
9:53
So if all the big players are getting hit, are
9:56
the hackers just too good? Or are the companies
9:59
failing at something basic? I'm going to quote
10:01
someone here, Rich Atkinson from Airtame, because
10:04
he put it so bluntly. He said these attacks are
10:05
not new nor particularly sophisticated. So the
10:09
industry knows about this stuff. They absolutely
10:11
know about phishing and credential harvesting.
10:13
These aren't some secret zero -day exploits.
10:16
So why does it keep happening? It comes down
10:18
to architecture, specifically a failure to implement.
10:22
Zero trust and, you know, robust multi -factor
10:26
authentication or MFA on their internal tools.
10:29
Zero trust. We hear that buzzword all the time.
10:32
What does it actually mean in practice? Think
10:34
of old security like a castle. Yeah. Big walls,
10:37
big moat. Once you're inside, you're trusted,
10:40
you can go anywhere. And stealing that employee's
10:42
password was like getting through the main gate.
10:44
Exactly. Once they were in, the system said,
10:47
oh, you have a password. Welcome. Look at everything.
10:49
Okay. And zero trust. Zero trust is like a high
10:53
security hotel. Just because you're in the lobby
10:55
doesn't mean you can get into the penthouse.
10:57
You need a key card for the elevator, a key for
10:59
the floor, a key for the room. It never stops
11:02
checking. It assumes the bad guy is already inside.
11:04
So even with the password, a zero trust system
11:07
would have challenged them. Ideally, yes. It
11:10
should ask, OK, you have the password, but are
11:12
you on the usual device? Why are you trying to
11:14
download 280 ,000 records at 3 door a .m.? And
11:18
clearly that didn't happen here. No. Australian
11:21
enterprises are failing to build systems that
11:23
assume credentials will be compromised. They're
11:26
still just building bigger castle walls. It's
11:28
frustrating. We tell everyone to put two -factor
11:31
on their Facebook account. How is a major telco
11:34
missing this on a critical internal database?
11:37
It often comes down to friction and old systems.
11:40
That order management system might be 10, 15
11:43
years old. Retrofitting modern security onto
11:46
old tech is hard. It's expensive. And it slows
11:49
things down. It does. So they trade security
11:51
for speed until the breach happens. And then
11:54
they realize the cost of not doing it was much,
11:56
much higher. So let's pivot to the so what part
11:59
of this. We've analyzed it. What did we learn
12:02
and what should people do? Let's start with any
12:03
businesses listening. For businesses, the takeaway
12:06
is an absolute intolerance for single factor
12:09
authentication. A single password is just negligence
12:12
at this point. If you have employees accessing
12:14
customer data, MFA has to be mandatory. No exceptions.
12:18
And there's a second layer too, right? Yes. Monitoring
12:21
for data exfiltration. to find that for us. We
12:23
spend so much money stopping people getting in,
12:26
the firewalls, the antivirus. We forget to watch
12:29
what's going out. Data exfiltration is the theft.
12:32
If a system that usually looks at one record
12:35
at a time suddenly exports a list of 280 ,000,
12:38
alarms should be screaming. It's like a bank
12:41
teller suddenly walking out with a wheelbarrow
12:43
full of cash. Even if they have a badge, someone
12:45
should probably ask a question. Precisely. Automated
12:48
tools can spot this. User Dave usually looks
12:51
at 50 records a day. Today he looked at 50 ,000.
12:53
That's an anomaly. Block it. Okay, now for our
12:57
listeners, the everyday users. What's the to
12:59
-do list? Number one, the modem. If you're using
13:03
the ISP's modem and you've never changed the
13:04
password on the sticker, do it today, right now.
13:07
Don't let your rider become a zombie for the
13:09
faceless game. Exactly. Number two. Vigilance
13:12
on texts. We saw how good that scam text was.
13:15
If you get a text about billing or maintenance,
13:17
do not click the link. No matter how real it
13:19
looks. Go to the website directly. Type it into
13:21
your browser yourself. Takes 10 extra seconds.
13:24
And finally. Password hygiene. I know we say
13:27
it all the time, but use a password manager.
13:30
If you are using the same password for your iNet
13:32
account that you use for your bank, that's called
13:34
credential stuffing, hackers take that one password
13:37
and try it. So one breach becomes a breach of
13:40
your entire life. It can be. Unique passwords
13:43
are your only real defense. It's simple advice,
13:46
but it works. It does. And I want to leave our
13:49
listeners with one final thought. We trust these
13:52
companies with our entire digital lives. But
13:55
if a massive telco with all its resources can
13:59
be opened up by one employee clicking one phishing
14:01
link, how secure is the vendor you trust with
14:05
your data? That is a sobering thought. It really
14:07
highlights that security isn't something you
14:10
can just outsource and forget about. It's an
14:11
active responsibility. Well, on that note, thank
14:14
you for walking us through all this. It's complex
14:16
stuff, but understanding how these failures happen
14:18
is the best way to protect yourself. Absolutely.
14:21
Stay curious and stay skeptical. If this discussion
14:24
has raised any red flags for you, for your own
14:26
business's safety, maybe you're wondering if
14:29
your internal tools have the right MFA, or if
14:31
you're vulnerable, we strongly suggest you go
14:33
to www. Thank you. www .kinsoft .com .au. You
14:39
can discuss your security and your IT needs with
14:41
people who live and breathe this stuff. Don't
14:43
wait for the breach to happen. Thanks for listening
14:46
to Tech Talks with Kinsoft. We'll catch you next
14:49
time.