Latest / Tech Talks With Kinsoft / Lynx Ransomware Targets CBS Tasmania: “Ethical” Claims vs. Reality

Transcript

Lynx Ransomware Targets CBS Tasmania: “Ethical” Claims vs. Reality · Tech Talks With Kinsoft

• 0:00
  Hello and welcome to Tech Talks with Kinsoft.
• 0:02
  It's Friday, January 16th, 2026. I'm your host.
• 0:07
  And if you've been following the news lately,
• 0:09
  you might feel like the digital ground is just
• 0:11
  constantly shifting beneath your feet. It really
• 0:13
  is. And this is the show where we try to, you
• 0:15
  know, stop the doom scrolling, take a step back
• 0:18
  and actually unpack what's defining our security
• 0:20
  landscape. We take the reports, the data, all
• 0:22
  the messy reality of it and figure out what it
• 0:25
  actually means. It's great to be here. And you're
• 0:27
  so right about the ground shifting. I mean, we're
• 0:29
  starting 2026 with a story that feels like a
• 0:32
  bit of a throwback to last year's chaos. A twist
• 0:36
  that really makes you question the motives of
• 0:39
  the people behind the keyboards. Yeah. Today
• 0:41
  we're looking at a cyber attack on a Tasmanian
• 0:43
  nonprofit called Community Based Support, or
• 0:46
  CBS. This all went down late last year, back
• 0:49
  in October. Right. And on paper, it looks like
• 0:51
  a standard data breach. Bad guys get in, data
• 0:54
  gets out. But there's this bizarre layer of,
• 0:57
  well, I guess you'd call it... corporate irony
• 1:00
  on top of the whole thing. Irony is a very polite
• 1:03
  way of putting it. It's more like a paradox.
• 1:06
  The group behind this is the Lynx ransomware
• 1:08
  gang. And if you read their marketing material,
• 1:11
  and yes, these criminal gangs actually have marketing
• 1:14
  material. Unbelievable. They claim to have a
• 1:16
  strict policy against targeting nonprofits and
• 1:19
  hospitals. Right. The quote unquote ethical criminal.
• 1:23
  The Robin Hoods of the dark web. We'll steal
• 1:26
  your data, but we won't steal that data. Precisely.
• 1:29
  They want to project this image of being like
• 1:31
  a reasonable business partner. They want victims
• 1:33
  to think, oh, these are the nice criminals we
• 1:35
  can negotiate. But this attack on CBS. Just completely
• 1:38
  dismantles that. It does. So today we aren't
• 1:42
  just reporting on a breach. We're using this
• 1:44
  as a case study to look at the volatility of
• 1:47
  this whole hacker ethics myth and maybe more
• 1:49
  importantly, the state of ransomware now that
• 1:51
  we're here in 2026. OK, so we've got a lot to
• 1:54
  get through. We need to look at the specific
• 1:55
  data exposed because it's genuinely upsetting.
• 1:58
  We have to look at the sheer volume of attacks
• 2:00
  hitting Australia. Spoiler alert, the numbers
• 2:02
  are bad. They are very bad. And I want to talk
• 2:05
  about what this all means if you're a business
• 2:06
  leader listening. If the ethical hackers are
• 2:09
  coming for nonprofits, then who is safe? So let's
• 2:12
  start with the victim. Who is community -based
• 2:14
  support? To really get the severity of this,
• 2:17
  you have to look at who they serve. CBS Tasmania,
• 2:21
  I mean, they're not a tech startup. They're not
• 2:23
  a bank. No. They're a not -for -profit organization.
• 2:25
  They're dedicated to aged care, disability services,
• 2:29
  and independent living support. Their whole reason
• 2:32
  for being... is helping people stay in their
• 2:34
  homes. So we're talking home modifications, social
• 2:37
  hubs, helping people with daily tasks, the really
• 2:40
  essential human stuff. Exactly. And to do that
• 2:44
  job, to verify eligibility, to tailor that care.
• 2:48
  They have to hold incredibly sensitive data.
• 2:51
  You can't run an aged care service without knowing
• 2:53
  someone's health status, their my aged care number,
• 2:57
  their Medicare number, their pension details.
• 2:59
  I was looking at their privacy policy and it's
• 3:00
  extensive. They collect this stuff because, well,
• 3:03
  the government requires it and the service demands
• 3:05
  it. But that just creates this massive honeypot
• 3:07
  of data. It really does. And that data is valuable,
• 3:11
  regardless of the moral standing of the organization
• 3:13
  that's holding it. So take us back to October
• 3:15
  2025. How did this all unfold? Well, CBS just
• 3:19
  popped up on the Lynx Games dark web leak site.
• 3:21
  They posted proof of the incident on October
• 3:24
  10th. Now, CBS came out and they did confirm
• 3:27
  a cyber incident. They said it was contained
• 3:29
  and thankfully had no impact on operations. Which
• 3:33
  is a small miracle in itself. I mean, usually
• 3:35
  operations just grind to a halt. It is a credit
• 3:38
  to their IT resilience, for sure, that they kept
• 3:40
  services running. You know, while the doors stayed
• 3:43
  open, the digital vault was cracked. They figured
• 3:46
  out that a subset of data was copied. And this
• 3:49
  is where I want to pause, because subset of data
• 3:51
  sounds so clinical, so sterile. It does. But
• 3:53
  when you look at what Lynx posted to prove they
• 3:56
  had access, the proof of life, so to speak, it's
• 3:59
  chilling. Yeah. They posted an employee detail
• 4:01
  form, a tax invoice, and then there was this
• 4:03
  one photo that just made my stomach turn. You're
• 4:05
  talking about an ID card? Yeah, a photo of a
• 4:07
  working with vulnerable people ID card. It's
• 4:10
  just such a visceral example of what we're dealing
• 4:12
  with. That card belongs to a staff member who
• 4:16
  has been vetted to work with at -risk people.
• 4:19
  By publishing that, Lynx isn't just proving they
• 4:21
  hacked a server. No, they're doxing a care worker.
• 4:24
  Exactly. They're exposing names, residential
• 4:27
  addresses, ID numbers of the very people who
• 4:30
  are trying to protect the community. It just
• 4:32
  proves that the human element is the ultimate
• 4:34
  vulnerability. You can have firewalls, policies,
• 4:36
  whatever. But if a sophisticated actor wants
• 4:39
  in or just one person clicks the wrong link,
• 4:41
  that data is gone. But this brings me back to
• 4:44
  that ethical criminal nonsense. You mentioned
• 4:47
  Lynx has a strict policy. I'm looking at their
• 4:49
  manifesto from July 2024 right now. The press
• 4:52
  release, as they called it. It's incredible.
• 4:54
  It's insane. They literally say their clear intention
• 4:56
  is to avoid undue harm. They say they encourage
• 4:59
  dialogue and resolution rather than chaos. It
• 5:02
  sounds like a mediation firm. We're just here
• 5:04
  to facilitate a transaction. It's branding. It's
• 5:07
  pure and simple. We have to understand that in
• 5:10
  2026, ransomware is a business. It's an industry.
• 5:13
  And like any industry, they have public relations
• 5:15
  issues. Lynx tries to position themselves as
• 5:18
  the clean option to lower the heat from law enforcement.
• 5:21
  Don't chase us, FBI. We don't hit hospitals.
• 5:24
  Exactly. If you attack a hospital and people
• 5:26
  die because systems go down, the full weight
• 5:29
  of the global intelligence community comes down
• 5:31
  on you. But if you attack a car parts manufacturer,
• 5:33
  maybe you fly under the radar. But the reality
• 5:36
  check here is brutal. Despite that manifesto,
• 5:40
  they hit CBS. They hit CBS. And it's not just
• 5:42
  CBS. They hit VET track. A student management
• 5:46
  system. That's education data. And if you look
• 5:49
  at their broader list, they have over 300 victims.
• 5:52
  Clutch Industries Automotive Manufacturing lost
• 5:54
  350 gigs of engineering docs. Brown and Hurley,
• 5:57
  the truck dealership, lost 170 gigs of HR data.
• 6:01
  Oof. That HR data is the key, isn't it? That's
• 6:03
  where the identity theft really kicks in. That's
• 6:05
  the goldmine. So if they have a manifesto, why
• 6:07
  just ignore it? Are they just liars? Or is there
• 6:09
  something more structural happening here? That's
• 6:12
  the critical question. I think we have to remember
• 6:14
  how modern ransomware works. It's rarely one
• 6:18
  guy in a hoodie doing everything. It's ransomware
• 6:20
  as a service or a race. OK, so break that down
• 6:23
  for us. Think of it like a franchise model. The
• 6:26
  Lynx developers, they write the malicious software
• 6:28
  and they run the payment site, their corporate
• 6:31
  HQ. Then. They rent that software out to affiliates,
• 6:35
  freelance hackers who actually break into the
• 6:38
  networks. So HQ might write a manifesto saying
• 6:41
  we love nonprofits, but the affiliate who just
• 6:44
  broke into the server sees a payday and doesn't
• 6:46
  care. Bingo. The affiliate gets a commission,
• 6:49
  usually 70 to 80 percent of the ransom. So if
• 6:52
  they stumble into a nonprofit like CBS, are they
• 6:54
  going to walk away because of a manifesto on
• 6:56
  a website? No way. They want their cut. Exactly.
• 6:59
  The developers might technically disapprove,
• 7:02
  but they still host the data on the leak site
• 7:04
  because they want their cut, too. Money beats
• 7:06
  the manifesto every single time. That makes the
• 7:09
  whole ethical claim even more dangerous because
• 7:12
  it gives victims this false sense of security.
• 7:14
  Oh, we're a charity. We're safe. No, you're not.
• 7:17
  You're just a target with a different tax status.
• 7:19
  Correct. And we can say this isn't an isolated
• 7:21
  incident. If we zoom out to the stats from borderless
• 7:24
  CS and black fog for late 2025 and early this
• 7:27
  year, the volume is just staggering. Yeah, I
• 7:30
  was looking at the January 2025 numbers, a record
• 7:33
  breaking 92 publicly disclosed attacks in one
• 7:36
  month. That was up 21 percent from the year before.
• 7:39
  And it didn't slow down. By December, we were
• 7:42
  still seeing nearly 80 attacks a month. And look
• 7:44
  at the sectors. Despite all the talk about avoiding
• 7:47
  critical infrastructure, health care was the
• 7:49
  most targeted sector in late 2025. 14 attacks
• 7:53
  in December alone. That is terrifying. So where
• 7:56
  does Australia sit in all this? Because it feels
• 7:58
  like we're hearing about a new breach every single
• 8:00
  week. We are punching way above our weight, unfortunately.
• 8:02
  In December 2025, the U .S. made up about 46
• 8:06
  % of victims, which you'd sort of expect. Sure,
• 8:08
  big economy. But Australia was second globally.
• 8:10
  We made up 14 % of the victims. 14%. That is
• 8:14
  a massive slice of the pie for a country our
• 8:16
  size. Why are we such a target? It's a combination
• 8:19
  of things. We're a wealthy nation. We digitize
• 8:22
  very quickly. But our cybersecurity maturity
• 8:24
  hasn't always kept pace. We're seen as, you know,
• 8:27
  cash rich and time poor. Let's talk about some
• 8:30
  of the big ones, because it's not just the volume,
• 8:32
  it's who's getting hit. And not just to list
• 8:34
  them, but to look at the types of attacks. Like
• 8:36
  we had the massive data dumps, like MediSecure.
• 8:40
  Right. That was a direct hit on a data aggregator.
• 8:43
  12 .9 million Australians. That is basically
• 8:46
  half the country having their prescriptions and
• 8:49
  Medicare numbers exposed. It's a mass casualty
• 8:52
  event in digital terms. But then you have the
• 8:55
  supply chain stuff, right? Like Volkswagen. Yes.
• 8:57
  800 ,000 EV owners exposed. And that wasn't necessarily
• 9:01
  a hack of the car itself, but a configuration
• 9:03
  error in the data handling. It exposed geolocation
• 9:06
  data. Which is a nightmare. If you can track
• 9:08
  a car, you can track the person. And then Qantas,
• 9:10
  up to six million records exposed, but that came
• 9:12
  through a call center breach, didn't it? Exactly.
• 9:14
  This is the third party risk we're always talking
• 9:16
  about. Qantas might have great security, but
• 9:19
  if the call center they hired has a weak password
• 9:21
  policy, the data flows out just the same. Even
• 9:24
  politicians aren't safe. The United Australia
• 9:26
  Party and Trumpet of Patriots got hit. Which
• 9:29
  just shows you that ideology doesn't matter to
• 9:31
  the algorithm. A ransomware scanner doesn't care
• 9:34
  about your politics. It cares about your open
• 9:36
  ports. We've talked a lot about links, but they're
• 9:39
  just one shark in the tank. The marketplace is
• 9:41
  crowded. We've got groups like Quillen, Ink Ransom,
• 9:44
  Medusa. Are they all pretending to be ethical,
• 9:47
  too? No, and that's the contrast. Take Medusa.
• 9:50
  They are incredibly aggressive. They demanded
• 9:52
  $150 ,000 from a small ENT clinic and $300 ,000
• 9:55
  from AirDex Australia. They don't write manifestos.
• 9:57
  They put up countdown clocks. And Quillen. Quillen
• 10:00
  is very active. They hit the West Quay Shopping
• 10:02
  Center and even the Church of Scientology in
• 10:04
  the U .K., posted visa and financial records.
• 10:07
  They're all about volume and pressure. You mentioned
• 10:09
  pressure. We used to talk about double extortion,
• 10:13
  encrypt the files, then threaten to leak them.
• 10:16
  But it feels like the tactics are evolving. It's
• 10:19
  getting nastier. It is. The industry term is
• 10:21
  moving toward triple extortion or even compliance
• 10:25
  weaponization. Compliance weaponization. That
• 10:28
  sounds like a lawyer's fever dream. What on earth
• 10:30
  does that mean? So imagine a hacker steals your
• 10:33
  data. You refuse to pay. In the past, they'd
• 10:36
  just leak it. Now, they might email your customers
• 10:39
  directly and say, hey, this company lost your
• 10:41
  data. You should sue them. Wow. Or, and this
• 10:44
  is the really nasty part, they might threaten
• 10:46
  to report the breach to the OAIC or the privacy
• 10:49
  regulator themselves, guaranteeing you get hit
• 10:52
  with a massive fine if you don't pay the ransom.
• 10:54
  So they're using our own privacy laws as a weapon
• 10:57
  against the victim. Pay us a million or pay the
• 11:00
  government 10 million in fines. Exactly. It turns
• 11:02
  the regulatory framework into part of their extortion
• 11:04
  toolkit. That is just diabolical. So let's pivot.
• 11:08
  If I'm a business owner listening to this, maybe
• 11:11
  I ran a midsize logistics firm or a nonprofit
• 11:14
  like CBS. What's the actual takeaway? Because
• 11:17
  get better firewalls feels a bit. 2015. Firewalls
• 11:22
  are baseline their table stakes. The real lesson
• 11:25
  from CBS and these other breaches is about blast
• 11:28
  radius. Explain that. Okay, so CBS had an ex
• 11:31
  -employee's tax invoice and documents filed with
• 11:34
  the health department. Why do they still have
• 11:36
  that accessible? If you get hit, the damage is
• 11:39
  determined by what the hackers can grab. If you
• 11:41
  delete data, you no longer need... data minimization,
• 11:44
  you limit the blast radius. You can't leak what
• 11:46
  you don't hold. Correct. If CBS had archived
• 11:49
  that data into cold storage offline backups or
• 11:52
  just deleted it after the statutory period, the
• 11:54
  hackers might have gotten in, but they would
• 11:56
  have found empty filing cabinets. But instead,
• 11:58
  they found that working with vulnerable people
• 12:00
  ID card. And that creates a lifelong headache
• 12:02
  for that employee. We should touch on that personal
• 12:04
  impact. If you're the person whose ID card was
• 12:07
  in that leak, what actually happens? It's not
• 12:09
  just change your password, is it? No, for a Tasmanian
• 12:12
  resident in this scenario, it's an administrative
• 12:14
  nightmare. Service Tasmania guidance says if
• 12:17
  your driver's license is compromised, you have
• 12:20
  to apply for a whole new license number, not
• 12:22
  just a new card, a new number. Which means updating
• 12:25
  every single service that uses it to verify who
• 12:28
  you are. Right, and if that specific personal
• 12:30
  information card is compromised, it's the same
• 12:32
  thing. You're likely directed to ID care. which
• 12:36
  is a fantastic service. But having to use it
• 12:38
  means your life has already been completely disrupted.
• 12:41
  You are now on Identity Watch for years. It's
• 12:44
  the gift that just keeps on giving. It is. And
• 12:46
  the government response, you know, the ACSC,
• 12:48
  the OAIC, they're there to notify and regulate.
• 12:51
  In the CBS case, they determined a subset was
• 12:54
  taken and make sure notifications went out. But
• 12:57
  regulation can't put the toothpaste back in the
• 12:59
  tube once that data is on the dark web. It's
• 13:01
  there. So we have a marketplace of criminals
• 13:03
  who may or may not lie about their ethics. We've
• 13:06
  got a franchise model that incentivizes attacks
• 13:08
  on everyone. And we have a regulatory environment
• 13:11
  that hackers are now weaponizing. It just feels
• 13:13
  like we're walking through a minefield. We are.
• 13:16
  And I think the provocative thought for 2026
• 13:18
  is this. The line between the ethical hacking
• 13:21
  groups and the ruthless ones is gone. It's a
• 13:25
  distinction without a difference. The burden
• 13:27
  of defense has shifted. It's no longer just about
• 13:29
  preventing entry. Because as we see with supply
• 13:32
  chain attacks, entry might happen through a vendor
• 13:34
  you trust. So the goal is resilience. The goal
• 13:37
  is asking, if they get in today, can we survive
• 13:41
  it? And how much data will they actually find?
• 13:44
  We might be entering an era where data breaches
• 13:46
  are treated more like natural disasters inevitable.
• 13:48
  The question is, is your house built to withstand
• 13:51
  the hurricane? That is a very heavy reality check,
• 13:54
  but a necessary one. Hope is definitely not a
• 13:56
  strategy here. No, hope is not a strategy. Preparation
• 13:59
  is. Well, we've covered a lot of ground today,
• 14:01
  from the hypocrisy of the Lynx gang to the hard
• 14:04
  reality of Australian cyber stats. It's complex.
• 14:07
  It's scary. But ignoring it is the absolute worst
• 14:10
  thing you can do. Absolutely. Awareness is the
• 14:13
  first step to defense. Now, if you're listening
• 14:15
  to this and you're the one responsible for that
• 14:18
  blast radius in your company and you're maybe
• 14:20
  starting to sweat a little bit thinking about
• 14:22
  your own data retention policies, good. That
• 14:25
  means you're paying attention. But you don't
• 14:27
  have to panic. Panic leads to bad decisions.
• 14:29
  You need a plan. Exactly. We don't want you to
• 14:32
  be the case study on our next show. So if you
• 14:34
  want to shore up your IT defenses or just figure
• 14:37
  out where your vulnerabilities actually are,
• 14:39
  you need to talk to the experts. You should head
• 14:41
  over to www .kinsoft .com .au. They live and
• 14:46
  breathe this stuff, so you don't have to. That's
• 14:48
  www .kinsoft .com .au to discuss your security
• 14:52
  and IT needs. Get ahead of the problem before
• 14:54
  it becomes a headline. Couldn't have said it
• 14:56
  better myself. Thank you so much for joining
• 14:58
  us on Tech Talks with Kinsoft. Stay safe out
• 15:01
  there, watch your data, and we'll catch you next
• 15:02
  time. Bye for now.