Latest / Tech Talks With Kinsoft / Australian Super Fund Cyberattack: Prevention and Response

Transcript

Australian Super Fund Cyberattack: Prevention and Response · Tech Talks With Kinsoft

0:00
Welcome to Tech Talks with Kinsoft. This is the
0:02
show where we try to cut through some of the
0:04
noise, the digital static, and, you know, get
0:06
straight to the insights that matter. And lately,
0:10
you might have seen some headlines, making waves,
0:13
stories that maybe hit a bit close to home, especially
0:16
when they're talking about your financial security
0:18
in, well, this very digital world we live in.
0:22
Yeah, absolutely. So today we're really diving
0:25
into a situation that's pretty critical. It's
0:28
impacted a lot of Australians, possibly even
0:30
your own retirement savings. We're talking about
0:32
a major cyber incident that hit the Australian
0:36
superannuation sector and crucially, what it
0:39
all means for your financial future. It is. And
0:42
it's understandable that it's caused a lot of
0:44
concern. So our mission today really is to unpack
0:47
what actually happened, why it's so significant
0:50
for you, the listener, and maybe most importantly,
0:52
give you some concrete practical steps you can
0:55
take, things you can do to safeguard your financial
0:57
future. Right. We want to bring clarity, some
0:58
useful insights, not just, you know, drown everyone
1:01
in tech jargon. Exactly. And the urgency here,
1:04
why we're covering this now, is this isn't just
1:06
theory anymore, is it? No, not at all. Around
1:08
April 4th, 2025. Several really big Australian
1:13
super funds. We're talking Australian super,
1:15
Australian Retirement Trust, Host Plus, Rest,
1:18
CBUS, Insignia. They were all hit by what looks
1:21
like a coordinated cyber attack. Now, before
1:24
we go any further, just a quick point. If you
1:27
happen to be a StockSpot super customer, good
1:30
news for you. Your fund was not caught up in
1:32
this specific breach. So you can breathe a little
1:36
easier on that front. That's definitely reassuring
1:38
for them. OK, so let's get into the mechanics.
1:42
What actually happened here? What was the attack
1:44
method? Because it wasn't like some super sophisticated
1:47
complex hack deep inside their systems, was it?
1:50
No, not really. It was surprisingly simple, actually,
1:53
but very effective. It's a technique called credential
1:56
stuffing. Have you heard much about that? I've
1:58
heard the term, but maybe you could break it
1:59
down for us. How does that actually work? Sure.
2:01
So what's kind of fascinating. and a bit scary,
2:04
is how straightforward it is. Imagine hackers
2:07
get their hands on a huge list, maybe millions
2:10
of usernames and passwords. Okay. These usually
2:13
come from past data breaches, you know, completely
2:15
different websites maybe breached years ago.
2:18
Could be an old social media site, an online
2:20
shop you used once, a forum you forgot about.
2:23
Right, those old breaches we hear about. Exactly.
2:26
So the hackers take this massive list and they
2:29
just... automate the process of trying these
2:31
logins, stuffing them into other websites. In
2:34
this case, the login pages for these super funds.
2:36
Wow. So hang on. If I use the same password for
2:39
my super account, let's say. as I did for, I
2:42
don't know, some stream service that got hacked
2:44
five years back, that old compromised password
2:47
could suddenly unlock my retirement savings.
2:49
That's precisely it. It's quite a sobering thought,
2:51
isn't it? It really is. So the vulnerability
2:53
wasn't necessarily a flaw deep within the Superfund's
2:56
own security, but more exploiting our habits,
2:59
our password reuse. Exactly. It really shines
3:02
a light on how often the weakest link isn't the
3:05
sophisticated tech, but, well. Us. Or individual
3:08
security practices. Yeah. You can build the strongest
3:11
digital fortress. But if someone reuses a key
3:14
that's already been stolen from somewhere else,
3:16
somewhere less secure, well, that fortress door
3:19
just got opened. And the impact wasn't just theoretical,
3:22
sadly. Australian Super, they confirmed 600 members
3:25
had their accounts accessed. But here's the bit
3:28
that really stands out. Specifically, 10 of those
3:32
members lost a combined a $750 ,000. That's almost
3:36
half a million U .S. dollars. Ouch. Now, good
3:40
news, if you can call it that, is Australian
3:42
Super did fully reimburse those members. That's
3:44
important. Definitely. But the information we
3:46
have suggests something critical about how that
3:48
was funded. Since these industry super funds
3:51
don't operate like banks with their own capital
3:53
reserves, the reports say these losses were covered
3:56
using other members' fees. Right. And when you
3:58
hear that. Well, it makes you think, doesn't
4:01
it? About the bigger picture, the shared pool
4:04
of funds. It absolutely raises a big question.
4:07
You know, what was different about the funds
4:08
where money wasn't actually stolen? Because we
4:12
know Rest Super, for example, they confirmed
4:14
suspicious activity on 8 ,000 accounts. Way more
4:17
than Australian Super. 8 ,000. Wow. Yeah, but
4:20
critically, no money was lost. Host Plus also
4:24
said no financial losses. Australian Retirement
4:28
Trust hadn't found suspicious transactions when
4:30
this was reported. So it suggests that getting
4:32
in was one thing. Right. But actually getting
4:34
money out was another challenge, thankfully,
4:37
in many cases. And that difference, looking at
4:39
where money wasn't lost, seems to point directly
4:41
at one key thing. Multi -factor authentication
4:44
or MFA? Ah, yes. The crucial layer. That $750
4:49
,000 that was stolen. The sources we looked at
4:52
explicitly say it could likely have been prevented
4:54
if those funds had offered and importantly enforced
4:56
2FA, which is just another term for MFA on those
4:59
accounts. Exactly. It feels like such a basic
5:01
security step that just wasn't there for some.
5:03
It really is fundamental in today's world. MFA,
5:07
you know, at its heart, it's just about meeting
5:10
something extra besides your password to prove
5:13
it's really you. Like a second lock on the door.
5:16
Precisely. Think of it in categories. There's
5:18
something you know that's your password. Then
5:20
something you have, like a code from an app on
5:22
your phone or maybe a little physical security
5:24
key. And something that's biometrics, like a
5:28
fingerprint or face scan. The key is they are
5:31
independent. So even if a hacker gets your password,
5:35
they still hit that second wall. They need that
5:37
other factor. And what about SMS codes, you know,
5:40
where they text you a number? Lots of places
5:42
use that. Yeah, they do. And look, it is a form
5:45
of MFA and it's certainly better than just a
5:47
password, but it's increasingly seen as, well,
5:51
outdated and vulnerable. Criminals have got pretty
5:54
clever at intercepting those SMS codes or worse,
5:57
they do something called a SIM swap attack. Right.
5:59
I've heard about that. That sounds nasty. It
6:01
is. They basically trick your phone company into
6:04
transferring your number to their phone. So when
6:07
you try to log in, that verification code goes
6:10
straight to the bad guy. Oh, wow. OK. Yeah. It's
6:13
a surprisingly effective workaround for SMS MFA.
6:16
That's why security pros really push for authenticator
6:19
apps like Google Authenticator or Authy or even
6:23
better, those physical hardware keys. They're
6:25
much harder to compromise. So this whole incident
6:27
wasn't just about. Stolen passwords and missing
6:30
MFA, then. The information suggests it exposed
6:33
wider issues, too, like weaknesses in internal
6:36
controls, financial processes. Exactly right.
6:39
If you look at the bigger picture, it's about
6:41
the whole chain of trust and verification inside
6:44
the organization. A cyber incident might start
6:47
with stolen logins, an IT problem, you could
6:49
say. But the impact often ripples right into
6:51
finance operations. The problem wasn't just that
6:54
hackers got access. It was that once they were
6:56
in, the actual payment systems, the workflows
6:59
for moving money, didn't have enough checks and
7:01
balances built in. They lacked the layers needed
7:05
to maybe flag, escalate, pause, or just completely
7:08
stop a suspicious transaction before the money
7:10
actually left the building. So things like needing
7:13
a second person to approve a large withdrawal
7:16
or... Extra checks for unusual activity, that
7:19
kind of thing. Precisely. Yeah. We talk about
7:21
segregation of duties or multi -person approval
7:23
in finance. Yeah. Even if someone bypasses the
7:26
first login hurdle, these internal checks should
7:29
kick in. They should be separate, require maybe
7:32
another human or another system verification
7:34
before big sums can move. That makes total sense.
7:37
It's like even if someone picks the first lock
7:39
on the vault door, there should be another lock
7:41
inside, maybe needing a different key or a manager's
7:44
approval before you can actually get to the cash.
7:46
That's a great analogy. And it points to a deeper
7:49
challenge, which is modernizing some of these
7:51
older financial systems and processes. Right.
7:53
These institutions often have processes built
7:56
for a slower, perhaps more manual world. And
7:59
now they're facing these incredibly fast automated
8:02
cyber attacks, trying to rely on old methods
8:05
like. say, phoning a member back to double check
8:08
a large withdrawal request. Yeah, that sounds
8:10
slow. It's too slow. Just can't keep pace with
8:13
automated fraud attempts happening in milliseconds.
8:15
Plus, it introduces delays and, frankly, the
8:18
risk of human error, especially under pressure.
8:20
That whole chain of trust needs updating for
8:22
the digital age. OK, so we've painted a picture
8:25
of how these attacks work and the vulnerabilities,
8:28
both user level and institutional. It really
8:30
underscores that we as individuals need to be
8:32
proactive. So let's shift to empowerment. What
8:35
can you listening right now actually do to put
8:38
a stronger shield around your super and frankly,
8:41
all your important online accounts? It might
8:43
feel a bit daunting, but there are definite steps.
8:45
Absolutely. And the good news is many of the
8:48
most powerful defenses are things you can control
8:50
yourself and they aren't necessarily super complicated.
8:53
Let's run through five key practical steps drawn
8:56
right from the lessons of this breach that you
8:58
should really think about implementing. Okay,
9:00
let's hear it. First, and honestly, I can't stress
9:02
this enough, use strong, unique passwords. We've
9:06
seen how reusing passwords is just, well, asking
9:09
for trouble. It's the number one way in, it seems.
9:12
It often is. So you need a good mix of letters,
9:15
numbers, symbols, and critically, a different
9:19
strong password for every single important account.
9:21
especially financial ones. Please don't use password
9:24
123 or your pet's name everywhere. Yeah, probably
9:27
not the best. My top tip here, get a good password
9:30
manager. Seriously. They generate complex, unique
9:33
passwords for you, store them securely, and often
9:36
fill them in automatically. Takes the hassle
9:38
out of it and massively boosts your security.
9:41
Good advice. What's number two? Number two, and
9:44
just as crucial. enable multi -factor authentication,
9:49
MFA, wherever it's offered. We talked about this.
9:51
If you're super fine, your bank, your email,
9:53
anything important offers MFA or 2FA, switch
9:56
it on. Now, today. Don't delay. Don't delay.
10:00
It's probably the single biggest security upgrade
10:02
you can make. Even if someone does get your password
10:05
somehow, MFA is designed to stop them cold. And
10:08
again, if you have a choice, aim for an authenticator
10:11
app or hardware key over SMS. if possible. Right.
10:14
Stronger options. Okay. Number three. Third,
10:16
regularly monitor your accounts. Now, I don't
10:19
mean obsessively checking every five minutes.
10:21
That's not healthy. No, but make it a habit maybe
10:24
once a month or even quarterly. Just log into
10:26
your super, your bank accounts, credit cards,
10:28
just scan for anything weird, unauthorized transactions,
10:31
changes to your address or phone number you didn't
10:33
make. Okay. If you see anything suspicious, anything
10:35
at all, report it immediately. Don't wait. Quick
10:38
action really can make a huge difference. Good
10:40
habit to build. What's fourth? Fourth, is about
10:43
being savvy. Watch out for the phishing scams.
10:47
Criminals are always trying to trick us. You
10:49
get those fake emails, text messages, maybe even
10:51
phone calls, trying to panic you into giving
10:53
up logins or personal info. Yeah, they can look
10:56
very convincing sometimes. They really can. Be
10:59
super cautious of anything asking you to click
11:01
weird links, download attachments, or provide
11:04
sensitive data, especially if it sounds urgent.
11:07
Remember, your Superfund or bank is very unlikely
11:10
to ask for your full password or login details
11:13
via email. If you're ever unsure, don't click
11:16
the link. Go directly to their official website
11:19
yourself or call them using a number you know
11:21
is correct. Always go direct. Got it. And the
11:23
last one, number five. And finally, number five.
11:26
Keep your contact details up to date. Seems simple,
11:29
but it's important. Make sure your email address
11:31
and phone number on file with your Superfund,
11:33
bank, everyone are current. Why is that so critical?
11:37
Because that's how they'll send you security
11:38
alerts. If there is suspicious activity, like
11:41
a login from a strange location or a password
11:43
change request, they'll notify you using those
11:46
details. If they're wrong, you won't get the
11:48
alert and you lose that crucial early warning.
11:51
Ah, okay. It makes sense. Vital for getting those
11:54
alerts quickly. Exactly. So those are great preventative
11:57
steps. But let's say... Worst case scenario,
12:01
despite your best efforts, you think, oh, something's
12:03
wrong. I suspect my account has been compromised.
12:06
We know acting fast is key. What's the absolute
12:09
first move? Right. If you suspect a breach, don't
12:13
panic, but act decisively. The very first thing.
12:16
Contact your super fund or bank immediately.
12:19
Find their official fraud hotline number. Don't
12:22
just Google it. Get it from their official site
12:23
or your statements. Okay. Call them. Tell them
12:26
you suspect a compromise. Explain why maybe you
12:28
saw a weird email, a transaction you don't recognize,
12:31
whatever it is. Ask them to lock the account
12:33
down right away and start an investigation. Lock
12:35
it down first. Got it. What next? Second, change
12:38
your password for that account immediately. And
12:41
crucially, if you've been naughty and reused
12:43
that password anywhere else, you need to change
12:46
it on all those other accounts too. Right away.
12:49
This is where that password manager habit really
12:51
pays off because it stops one breach turning
12:54
into many. Stops the domino effect. Makes sense.
12:57
And third. Third, be proactive. Check all your
13:01
other financial accounts, bank accounts, credit
13:03
cards, any investment accounts. Look for any
13:06
suspicious activity there, too. If criminals
13:08
got into one account or got hold of some of your
13:11
personal details, they might try to use that
13:13
information elsewhere or even try identity theft.
13:16
Right. Check everything. Yeah. Just be vigilant
13:18
across the board. Catching things early can save
13:21
you a massive amount of time, money, and frankly,
13:24
stress down the line. Cleaning up after a breach
13:26
is not fun. Prevention and quick response are
13:29
definitely the way to go. Okay, so wrapping this
13:31
up, what we've discussed today really throws
13:34
a spotlight on, well, two main things, doesn't
13:36
it? Firstly, how vital our own personal cyber
13:39
hygiene is, strong, unique passwords, always
13:42
using MFA. Absolutely fundamental. But secondly,
13:46
it also shows the bigger picture. The importance
13:49
of robust financial controls within these institutions
13:52
and how quickly modern automated attacks can
13:56
find the cracks in older, perhaps less agile
13:58
systems. It really does. And maybe it leaves
14:01
us with a final thought or perhaps a question
14:03
to ponder. You know, while the criminals are
14:05
constantly shifting, constantly evolving their
14:07
tactics. Always seem to be one step ahead sometimes.
14:09
It can feel like that, but. Our defenses, both
14:13
personal and institutional, they have to evolve
14:15
too. The next attack might look different, maybe
14:18
target something else entirely, but chances are
14:20
it'll exploit similar kinds of gaps, gaps in
14:23
process, gaps in technology, gaps in awareness
14:25
if we leave them open. So this incident, it's
14:29
a really powerful reminder, isn't it? To think
14:31
critically about the security of all our online
14:33
activity, not just super. It's an ongoing thing,
14:36
vigilance, adaptation. A continuous process.
14:39
Well said. Thank you for tuning in to Tech Talks
14:41
with Kinsoft. We genuinely hope this discussion
14:43
has given you some valuable insights and, more
14:47
importantly, some actionable advice to help you
14:49
better protect your digital self. We hope so,
14:51
too. Stay safe out there. And look, for any of
14:55
your security and IT needs, maybe you're thinking
14:57
about how to better protect your business after
14:59
hearing this or just want to understand these
15:01
threats more deeply, we absolutely encourage
15:03
you to visit us at www .kinsoft .com .au.