Latest / Tech Talks With Kinsoft / Gelatissimo Data Breach – DragonForce and the 352GB Heist

Transcript

Gelatissimo Data Breach – DragonForce and the 352GB Heist · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. It's great
• 0:02
  to be here. So when you think of gelatissimo,
• 0:04
  you probably think of like sunny Australian afternoons,
• 0:09
  right? Yeah, exactly. Artisanal gelato, happy
• 0:11
  memories. Right. It's this very innocent, everyday
• 0:14
  image. But today we are dragging that bright,
• 0:18
  sunny brand into the darkest corners of the internet.
• 0:21
  Which is quite the tonal shift. It really is.
• 0:23
  Because today we are unpacking a massive 352
• 0:28
  gigabyte Data heist. And it's one that brings
• 0:31
  the abstract world of cybersecurity right to
• 0:33
  the doorstep of everyday retail workers. Yeah,
• 0:36
  it's a very striking juxtaposition. And, you
• 0:38
  know, it perfectly illustrates the reality of
• 0:40
  the modern threat landscape. Definitely. Because
• 0:42
  we are dealing with this incredibly sophisticated
• 0:44
  ecosystem of extortion. And honestly, they do
• 0:47
  not care if you sell software, manufacture cars
• 0:50
  or, you know, scoop gelato. They really don't.
• 0:53
  So our mission for this exploration is to basically
• 0:56
  cut through the dense technical. jargon surrounding
• 0:59
  this recent ransomware attack. Right, because
• 1:01
  there's a lot of it. Exactly. We have a stack
• 1:03
  of incredibly detailed recent reporting here,
• 1:06
  primarily from Information Age and Cyber Daily.
• 1:11
  Excellent sources. Yeah. And we want to use those
• 1:13
  to uncover what this actually means for the human
• 1:16
  beings whose data is caught in the crossfire.
• 1:19
  Because there's a real human cost here. Right.
• 1:21
  We are looking beyond the flashy headlines to
• 1:23
  understand, like, the mechanics of the attack,
• 1:25
  the horrifying permanence of the data that is
• 1:28
  allegedly at risk, and, of course, the agonizing
• 1:31
  reality of a corporate extortion countdown. It's
• 1:33
  a lot to cover. It is. OK, let's unpack this.
• 1:36
  I think the best place to start is just with
• 1:38
  the scale of the target. And the sheer audacity
• 1:41
  of the claims being made by the four actors.
• 1:44
  Yeah, because Gelatissimo is not some small mom
• 1:46
  and pop operation. No, not at all. I mean, this
• 1:48
  is a massive franchise. They started right here
• 1:50
  in Sydney back in 2002. And they have grown to
• 1:53
  over 60 stores across Australia, plus around
• 1:58
  22 international locations. Which means they
• 2:00
  hold a massive amount of operational and employee
• 2:03
  data. A staggering amount. And according to the
• 2:05
  reporting, a ransomware group known as Dragonforce
• 2:08
  posted a listing for Gelatissimo on their dark
• 2:11
  web leak site. Right. And they claim to have
• 2:14
  stolen roughly 352 gigabytes of data from the
• 2:17
  company's systems. Which is just huge. It is.
• 2:20
  To put that in perspective for you listening,
• 2:22
  352 gigabytes of purely corporate and text -based
• 2:26
  data is... Like an absolute ocean of information.
• 2:30
  Yeah, we're talking about millions upon millions
• 2:33
  of pages of documents, spreadsheets, communications.
• 2:37
  Endless files. Exactly. And exfiltrating that
• 2:40
  amount of data is not an instant process. Right.
• 2:42
  It's not a quick copy and paste job you do in
• 2:44
  five minutes. No. Moving 352 gigabytes out of
• 2:47
  a corporate network without tripping alarms,
• 2:49
  that often implies that the attackers had persistent
• 2:52
  undetected access to the systems. Like for a
• 2:55
  significant period of time? Usually. Slowly,
• 2:57
  yeah. Slowly siphoning the data out before they
• 3:00
  ever even made their presence known. Wow. But
• 3:02
  to prove they actually have this massive warehouse
• 3:06
  -sized filing cabinet of data, they didn't just
• 3:09
  dump it all at once on the dark web. No. That's
• 3:11
  not how the extortion works. Right. Imagine someone
• 3:14
  stealing that massive filing cabinet. But to
• 3:17
  prove they have the leverage, they only slide
• 3:19
  six terrifying folders under your door. That's
• 3:22
  a great analogy. They released a very tiny, highly
• 3:25
  curated sample. Yeah. But I want to push back
• 3:28
  on the core premise here, though. OK, go ahead.
• 3:30
  Why target a gelato company? I mean, are we looking
• 3:33
  at some highly coordinated cinematic digital
• 3:35
  heist specifically plotting against gelatissimo?
• 3:39
  Or is this just like automated opportunism? It's
• 3:43
  the latter. And the Cyber Daily source provides
• 3:46
  a very clear profile of the attackers that answers
• 3:48
  that question entirely. OK, so who are they?
• 3:51
  So Dragon Force is not a team of rogue hackers
• 3:54
  huddled in a basement nursing some weird grudge
• 3:56
  against a gelato chain. Right. No vendetta against
• 3:59
  ice cream. Exactly. They operate a highly industrialized
• 4:02
  model. It's known as ransomware as a service
• 4:05
  or RAS. Ransomware as a service. Wow. Yeah. They
• 4:08
  essentially function as a malicious software
• 4:10
  vendor. So they build the infrastructure, but
• 4:12
  they don't necessarily execute the break in themselves.
• 4:14
  Spot on. They develop the malicious software.
• 4:18
  They maintain the dark web leak sites, you know,
• 4:21
  where the countdown timers are hosted. And they
• 4:23
  manage the negotiation portals used to extort
• 4:26
  the victims. So it's basically a platform. That
• 4:28
  is the core of the Reyes model. Dragon Force
• 4:31
  relies on what they call affiliates. Affiliates,
• 4:34
  like marketers. Like independent contractors
• 4:37
  of the cybercrime world. Oh, wow. Yeah. These
• 4:40
  affiliates, they scour the internet for literally
• 4:43
  any vulnerability. An unpatched server, a compromised
• 4:47
  password, a successful phishing email. Just knocking
• 4:50
  on digital doors until one opens. Exactly. And
• 4:53
  once they find a way in, they rent the Dragonforce
• 4:55
  platform to execute the actual ransomware deployment
• 4:58
  and the extortion. So how does the money work?
• 5:00
  Well, when a ransom is paid, Dragonforce takes
• 5:03
  a 20 % cut for providing the software and the
• 5:06
  platform. Okay. And the affiliate who actually
• 5:08
  executed the breach keeps the remaining 80%.
• 5:11
  That is literally a franchising model for cybercrime.
• 5:14
  It really is. I mean, the irony is incredibly
• 5:17
  bitter there, considering Gelatissimo relies
• 5:19
  on a franchise model for its own legitimate business.
• 5:22
  yeah the attackers are using the exact same scalable
• 5:25
  business structures to inflict the damage that
• 5:28
  is wild and it is a ruthless highly organized
• 5:31
  business like dragon force actively advertises
• 5:34
  its platform on russian language hacking forums
• 5:37
  to recruit skilled affiliates so they are recruiting
• 5:40
  openly yes they are also believed to have operational
• 5:44
  links to the notorious lock bit ransomware cartel
• 5:47
  oh lock bit they're huge very huge but the most
• 5:51
  important mechanism to understand here is their
• 5:54
  use of the double extortion tactic. Right, because
• 5:56
  the old model of ransomware was just about locking
• 5:59
  you out, wasn't it? Exactly. Hackers would encrypt
• 6:01
  your files and demand a ransom for the decryption
• 6:03
  key. It was basically a business interruption
• 6:05
  problem. Yeah, and if you had good backups, you
• 6:08
  could simply wipe your systems, restore the data,
• 6:10
  and ignore the hackers completely. But double
• 6:13
  extortion changes that. It does. It was invented
• 6:15
  specifically to bypass the defense of having
• 6:18
  good backups. Okay, so how does it work? So the
• 6:21
  affiliate doesn't just encrypt the data anymore.
• 6:24
  They steal it first. They take it out of the
• 6:26
  network. Right. They silently exfiltrate that
• 6:29
  352 gigabytes to their own servers. Then they
• 6:34
  deploy the encryption to lock the victim's systems,
• 6:37
  causing that immediate panic and business outage.
• 6:40
  So the company scrambles, they go to check their
• 6:42
  backups, right? Yes. And that's when the hackers
• 6:44
  reveal the second layer of extortion. They say,
• 6:46
  even if you can restore your systems, we have
• 6:49
  all your sensitive data and we will publish it
• 6:51
  to the dark web if you don't pay. It transforms
• 6:55
  a vandalism problem into a full -blown hostage
• 6:58
  situation. What's fascinating here is just how
• 7:00
  prolific this indiscriminate targeting has become.
• 7:04
  Dragon Force has claimed 505 victims to date.
• 7:07
  505? Yeah, and that number more than doubled
• 7:09
  in just a few months following last September.
• 7:12
  That's terrifying. In the exact same week, they
• 7:14
  listed Gelatissimo. They also listed a printing
• 7:16
  specialist, a landscaping company, an engineering
• 7:19
  firm, and a U .S. medical equipment supplier.
• 7:22
  So it really is totally random. Completely. They
• 7:24
  do not care what industry you are in. They only
• 7:27
  care that you have a database of human identities
• 7:29
  that they can monetize. Right. And to understand
• 7:32
  the. the severe credibility of their extortion
• 7:35
  threats, we really have to look at their track
• 7:37
  record. Definitely. Last year, Dragon Force claimed
• 7:40
  an attack on a Queensland -based organization,
• 7:43
  the Toowoomba Friendly Society Dispensary. A
• 7:47
  medical dispensary. Yes. They claim to have stolen
• 7:50
  nearly 36 gigabytes of data. And a medical dispensary
• 7:54
  hold a completely different classification of
• 7:56
  data. than a gelato shop. Radically different.
• 7:59
  I mean, you were moving from corporate operations
• 8:01
  into deeply private health information. Exactly.
• 8:04
  And when the dispensary presumably refused to
• 8:07
  pay the ransom, Dragon Force followed through
• 8:09
  on their threat. They leaked it all. They leaked
• 8:11
  the data. The information that became freely
• 8:14
  available on the dark net included medical documents
• 8:16
  with names, addresses, and even photographs of
• 8:19
  patients. Oh my God. It detailed highly sensitive
• 8:22
  specific medical treatments. Everything from
• 8:25
  methadone treatment to... prescriptions for emergency
• 8:27
  contraceptives. That is just beyond cruel. They
• 8:30
  also leaked staff pay details and high resolution
• 8:33
  scans of employees' Medicare cards and driver's
• 8:36
  licenses. Wow. So if Dragon Force is willing
• 8:39
  to weaponize the private medical history of a
• 8:42
  dispensary patient, just to prove a point. Yeah.
• 8:45
  The terrifying reality is that Gelatissimo's
• 8:48
  employees are facing that exact same ruthlessness.
• 8:51
  Absolutely. So what specific leverage did the
• 8:54
  hackers expose this time? What is actually in
• 8:57
  those six sample screenshots they used as proof
• 9:00
  of the breach? So the reporting from Information
• 9:03
  Age details the contents of those six screenshots.
• 9:06
  Right. And we must explicitly note here that
• 9:09
  these are the alleged contents of the breach.
• 9:11
  Very important distinction. This is what the
• 9:13
  hackers claim to hold used to intimidate the
• 9:15
  company into pay. Right. So looking at the list,
• 9:17
  the hackers clearly curated this sample to inflict
• 9:20
  maximum psychological and operational pressure.
• 9:23
  Oh, without a doubt. You can basically divide
• 9:25
  the evidence into two categories, I think, corporate
• 9:27
  leverage and personal ammunition. Let's look
• 9:29
  at the corporate leverage first. OK, so on the
• 9:32
  corporate side, the fourth and fifth screenshots
• 9:34
  were a bank transfer receipt and a detailed corporate
• 9:37
  bank statement. Right. Proving they had access
• 9:39
  to deep financial operations. And then the sixth
• 9:42
  screenshot amplifies that corporate leverage.
• 9:45
  significantly. It really does. It was a list
• 9:47
  of direct contact details. So emails and mobile
• 9:50
  numbers for corporate staff located in the Philippines,
• 9:53
  various franchising and operations teams in Australia,
• 9:56
  and crucially, the direct contacts for the chief
• 9:59
  executive officer and the chief financial officer.
• 10:02
  Wow. The CEO and CFO. That brings us to the personal
• 10:06
  ammunition, which is almost scarier. Yeah, the
• 10:08
  employee data. The first screenshot was an alleged
• 10:11
  spreadsheet listing employee first and last names,
• 10:14
  their gross earnings, their paid leave, overtime
• 10:16
  bonuses, and withheld taxes. Extremely granular
• 10:20
  payroll data. Extremely. And most alarmingly,
• 10:23
  that same spreadsheet. appeared to list the last
• 10:26
  four digits of the employee's tax file numbers,
• 10:28
  their TFNs. Which is highly sensitive. And then
• 10:31
  a second sample was just wild to me. It was an
• 10:33
  alleged visa application. Right. Containing a
• 10:36
  passport number, a phone number, a professional
• 10:39
  email address, and the person's actual home address.
• 10:42
  Just a complete identity kit right there. Yes.
• 10:44
  And the third sample was an incident report from
• 10:47
  a 2025 workplace accident. Yeah, which provides
• 10:51
  deeply personal, potentially sensitive medical
• 10:54
  or human resources context. So the threat model
• 10:57
  changes entirely depending on whose data we are
• 11:00
  looking at in that sample. Exactly. And the Information
• 11:02
  Age article actually includes... some critical
• 11:05
  insights from Nalin Arakulaj. The associate professor.
• 11:08
  Yes, an associate professor in cybersecurity
• 11:09
  at RMIT University. And he breaks down exactly
• 11:13
  how this data is weaponized. Okay, how does he
• 11:15
  explain it? Well, for the senior executives,
• 11:17
  the danger really lies in sophisticated corporate
• 11:20
  fraud. Like using those leaked contact details
• 11:23
  of the CEO or CFO. Exactly. Those are incredibly
• 11:26
  valuable because they enable what the industry
• 11:28
  calls whaling. Whaling. Like phishing, but for
• 11:31
  the big fish. Precisely. Highly targeted scams
• 11:34
  and impersonation attacks. Because, I mean, if
• 11:37
  threat actors have the CEO's exact mobile number,
• 11:41
  their internal email format, and the context
• 11:44
  of recent corporate bank transfers. They have
• 11:46
  everything they need. They can craft an incredibly
• 11:49
  convincing message. Like they can text a junior
• 11:51
  accountant at 4 .0 p .m. on a Friday claiming
• 11:55
  to be the CEO in an urgent meeting. I need you
• 11:58
  to authorize this massive wire transfer to a
• 12:00
  new vendor right now. Exactly. And they don't
• 12:03
  even need to hack the bank at that point. They
• 12:04
  just hack the human trust within the company.
• 12:07
  Right. The senior executives are the keys to
• 12:10
  the corporate vault. Yeah. But Professor Oroklige
• 12:12
  points out that the danger for junior staff is
• 12:15
  arguably much worse on a personal level. How
• 12:18
  so? Because the sensitive data exposed in those
• 12:21
  other screenshots, the tax file number details,
• 12:23
  granular earnings information, visa documents,
• 12:26
  and passport numbers that forms a complete identity
• 12:28
  profile. And this data isn't just used once,
• 12:31
  right? No, not at all. In the dark web economy,
• 12:33
  a profile containing a passport number, a home
• 12:35
  address and partial TFNs is bundled up and sold
• 12:38
  to identity brokers. Identity brokers. Yeah.
• 12:42
  Criminals use automated tools to exploit this
• 12:44
  information at scale. They use it to open fraudulent
• 12:47
  lines of credit, apply for loans or file fake
• 12:50
  tax returns. And the brutal reality here is that
• 12:53
  junior staff. The people making the gelato or
• 12:57
  handling the franchise administration, they generally
• 13:00
  have far fewer financial and legal resources
• 13:02
  to recover from having their identity stolen.
• 13:05
  Compared to a corporate executive. Absolutely.
• 13:07
  Here's where it gets really interesting. Professor
• 13:10
  Araklage provided a quote in the reporting that
• 13:13
  I think perfectly captures the terror of this
• 13:17
  situation. What did he say? He said, once this
• 13:20
  kind of data is out, you can't change it like
• 13:22
  a password. It can follow people for years. That
• 13:25
  is chilling. And it's so true. It is. Because,
• 13:29
  like, you can cancel a compromised credit card
• 13:31
  in 10 minutes, right? Avially. You can force
• 13:33
  a company -wide reset of every single login credential.
• 13:36
  Yeah, well. But you cannot easily change your
• 13:38
  tax file number. No, you can't. You cannot alter
• 13:40
  the history of a workplace injury. Changing a
• 13:43
  passport number involves significant bureaucratic
• 13:45
  hurdles. And your home address is your physical
• 13:48
  reality. This data is permanent. It is permanent.
• 13:51
  And that permanence is the engine of the extortion.
• 13:53
  Right. The attackers know that Gelatissimo knows
• 13:56
  this data cannot be taken back once it is published
• 13:59
  to the broader internet. Once it's out, it's
• 14:01
  out. Exactly. If a junior employee's visa application
• 14:04
  and passport details are leaked, they might not
• 14:06
  feel the impact tomorrow. Or even next month.
• 14:09
  Right. But three, four, five years down the line,
• 14:12
  they could go to apply for a mortgage. only to
• 14:15
  discover a string of defaulted loans taken out
• 14:18
  in their name. By someone who bought their identity
• 14:20
  profile for pennies on some Russian forum. Exactly.
• 14:23
  The psychological toll of that invisible threat
• 14:26
  hanging over the workforce is immense. Which
• 14:28
  brings us to the agonizing reality of the countdown
• 14:30
  timer. The ticking clock. Yeah. According to
• 14:34
  the reporting, at the time the articles were
• 14:35
  published, Dragon Force had set a timer on their
• 14:39
  dark web leak site. Right. They gave Gelatissimo
• 14:42
  less than five days. About four days and 12 hours
• 14:45
  to be exact. Barely any time at all. To respond
• 14:48
  before they threaten to publish the entire 352
• 14:51
  gigabyte data set. It is a completely artificial
• 14:54
  deadline. It's designed purely to force panic.
• 14:57
  Just to pressure them. Yeah. They want the corporate
• 15:00
  leadership to make a rushed emotional decision
• 15:03
  to pay the ransom before they even have time
• 15:06
  to fully understand the scope of the breach.
• 15:09
  So how does a company actually operate? when
• 15:12
  that clock starts ticking. Yeah. I mean, the
• 15:15
  public usually only sees a brief public relations
• 15:17
  statement, but behind the scenes, the pressure
• 15:20
  must be staggering. Oh, it's a war room environment.
• 15:23
  To understand the response, we really have to
• 15:25
  separate the hackers' psychological warfare from
• 15:28
  what Gelatissimo has actually confirmed to the
• 15:30
  press. Yes, let's stick to the facts. Based strictly
• 15:33
  on the official statements provided to Information
• 15:35
  Age and Cyber Daily, the company initiated a
• 15:38
  very specific sequence of events. First, Gelatissimo
• 15:41
  confirmed that they did detect unauthorized access
• 15:43
  to a part of their systems. Okay. They publicly
• 15:46
  acknowledged that a cyber incident is actively
• 15:48
  being investigated. Right. Second, immediately
• 15:51
  upon discovering the incident, they engaged external
• 15:53
  cybersecurity experts to contain the breach and
• 15:56
  run the forensics. So they called in the cavalry.
• 15:59
  And they also stated they are working urgently.
• 16:03
  To verify the third party's claims, which is
• 16:05
  crucial, they're trying to understand the exact
• 16:08
  nature and extent of the impacted information.
• 16:11
  And finally, they formally notify the Office
• 16:13
  of the Australian Information Commissioner, the
• 16:16
  OAIC, and the Australian Cybersecurity Center,
• 16:20
  the ACSC. If we connect this to the bigger picture.
• 16:23
  Yeah, you can see the incredible regulatory and
• 16:26
  operational tightrope the company is walking
• 16:28
  during those five days. By notifying the OAIC
• 16:31
  and the ACSC, they are triggering a massive legal
• 16:35
  and regulatory mechanism. They aren't just dealing
• 16:37
  with hackers anymore. No, they are no longer
• 16:39
  just fighting. the hackers. They are on the clock
• 16:41
  with the federal government. Right. The incident
• 16:44
  response team is facing this immense forensic
• 16:46
  bottleneck. Absolutely. They have external analysts
• 16:49
  desperately combing through network logs, just
• 16:52
  trying to reconstruct the attacker's path. Because
• 16:54
  they have to figure out if Dragonforce actually
• 16:57
  exfiltrated 352 gigabytes of data, or if they
• 17:01
  only managed to grab those six folders and are
• 17:03
  just bluffing about the rest. Right. Verifying
• 17:06
  the scale of the theft takes time. but the artificial
• 17:09
  countdown timer on the dark web. It doesn't care
• 17:12
  about forensic timelines. Not at all. And while
• 17:15
  the technical team is dealing with that forensic
• 17:18
  bottleneck, the leadership team is managing the
• 17:20
  legal reporting requirements. Because personal
• 17:23
  data is involved. Exactly. They have to navigate
• 17:25
  the notifiable data breaches scheme, assessing
• 17:28
  the risk of serious harm to individuals, and
• 17:31
  preparing to formally notify the affected employees
• 17:34
  and franchisees. And simultaneously, they are
• 17:37
  managing the human crisis. The staff. Yes. The
• 17:40
  company spokesperson explicitly stated they're
• 17:43
  apologizing for the concern the incident caused
• 17:45
  and that they take the protection of entrusted
• 17:47
  information very seriously. It's a very tough
• 17:50
  conversation to have. Imagine trying to communicate
• 17:52
  with a workforce that is... undoubtedly terrified
• 17:55
  about the exposure of their passports and tax
• 17:57
  files. While likely not having all the concrete
• 17:59
  answers yet because the forensic investigation
• 18:02
  is still underway. Exactly. You are dealing with
• 18:05
  an active extortion threat, regulatory demands,
• 18:09
  panicking employees, and media scrutiny all at
• 18:13
  the exact same moment. It's a nightmare scenario.
• 18:15
  So what does this all mean for you? For the listener.
• 18:18
  Right. When we synthesize the mechanics of the
• 18:21
  Dragon Force Reyes model, the curation of that
• 18:24
  sample data, and the impossible corporate tightrope
• 18:26
  of the response, what is the ultimate takeaway?
• 18:30
  It becomes very clear that this is not just a
• 18:32
  story about a gelato chain having a bad week.
• 18:34
  Not at all. It is a masterclass in understanding
• 18:36
  how invisible supply chains and everyday networks
• 18:40
  are the true targets of modern cybercrime. We
• 18:43
  often default to thinking that cyber warfare
• 18:45
  only targets massive financial institutions or
• 18:48
  defense contractors. Right, like the movies.
• 18:50
  But the reality is that franchising networks,
• 18:52
  retail chains, and the everyday mundane administrative
• 18:55
  data they hold. Like payroll processing, visa
• 18:58
  applications, incident reports. That is the high
• 19:00
  volume currency of the dark web economy. The
• 19:03
  threat actors don't care about the product being
• 19:05
  sold. They don't care about the gelato. They
• 19:08
  care about the database of human identities required
• 19:10
  to run the business. It really reframes how we
• 19:14
  must. Think about the information we hand over
• 19:16
  to our employers or the businesses we frequent.
• 19:19
  Definitely. We are trusting these organizations,
• 19:21
  not just with our labor or our transactions,
• 19:23
  but with our digital permanence. And that trust
• 19:26
  is being systematically tested by industrialized
• 19:29
  extortion operations that view literally every
• 19:31
  unpatched server as an opportunity to monetize
• 19:34
  human privacy. It's a sobering reality. It is.
• 19:38
  If today's discussion has you thinking about
• 19:40
  your own digital footprint, your business's vulnerabilities,
• 19:43
  or how to navigate this increasingly complex
• 19:45
  landscape, we strongly encourage you to visit
• 19:48
  www .kinsoft .com .au to discuss your own security
• 19:52
  and IT needs. Because you do not want to wait
• 19:55
  until an artificial countdown timer appears on
• 19:58
  a dark web forum to start taking your digital
• 20:00
  perimeter seriously. Preparation and proactive
• 20:03
  defense are the only ways to survive in this
• 20:05
  environment. To wrap up our analysis today, there
• 20:08
  is a broader societal implication here that builds
• 20:11
  on everything we have discussed. Something we
• 20:13
  all need to sit with as these attacks become
• 20:15
  more frequent. We spent a lot of time discussing
• 20:17
  Professor Arkaz's insight about how this data
• 20:20
  is indelible. Right. You can't just change it.
• 20:22
  If our most sensitive foundational information...
• 20:26
  Our passport numbers, our tax files, our medical
• 20:29
  histories cannot simply be reset like a compromised
• 20:33
  password. Are we rapidly approaching a future
• 20:36
  where we have to assume our personal history
• 20:39
  is permanently public? Wow. And if we accept
• 20:41
  that our data will eventually be breached, how
• 20:44
  does that fundamentally change the way we live,
• 20:46
  the way we establish trust, and the way we work
• 20:48
  online? That is an incredibly unsettling but
• 20:51
  entirely necessary thought to leave on. Thank
• 20:54
  you for exploring the mechanics and the human
• 20:56
  cost of this incident with me.