Latest / Tech Talks With Kinsoft / Scotch College Data breach August 25

Transcript

Scotch College Data breach August 25 · Tech Talks With Kinsoft

0:00
Hello and welcome back to Tech Talks with Kinsoft.
0:01
I'm your host. Today we have a heavy one. We
0:05
aren't just looking at the latest gadgets or,
0:07
you know, software updates. We are looking at
0:08
a stack of documents that paints a pretty worrying
0:11
picture of the education sector in Australia.
0:13
We've got news reports, a dense 160 -page compliance
0:17
manual, and forensic timelines of a major cyber
0:21
event. It is good to be here, and you are right
0:23
to call it heavy. We are diving into the intersection
0:26
of elite education, cyber vulnerability, and
0:29
the very strict rules that are supposed to be
0:31
keeping our data safe. So let's set the scene.
0:33
It is August 2025. We are talking about Scotch
0:37
College in Melbourne. This isn't just any school.
0:40
This is one of the most elite private schools
0:42
in the country, charging over $34 ,000 a year
0:45
for tuition with a history spanning 174 years.
0:48
And then over a single weekend. The lights go
0:51
out. It was a significant breach. And our mission
0:54
today is to analyze this event, not just as a
0:56
piece of news, but to understand why the education
0:58
sector is suddenly under such heavy fire. We
1:01
need to contrast the chaotic reality of a hack
1:03
like this against the rigid privacy frameworks
1:05
these schools operate under. It really is a crazy
1:08
story. How does an institution with that kind
1:11
of prestige, that kind of resource base, get
1:13
taken offline by an unknown third party? And
1:16
more importantly, what happens to the data of
1:18
alumni who include former premiers and high court
1:22
judges? That is the multi -million dollar question.
1:25
When you look at the source materials, specifically
1:27
the reporting from Peter A. Clark and the Cyber
1:29
News Center, the details of the Scotch College
1:32
incident reveal a lot about the current threat
1:35
landscape. Let's get into the timeline then.
1:37
It was August 15th, 2025. The principal... Dr.
1:41
Scott Marsh sends out a letter confirming that
1:44
over the weekend, an unauthorized third party
1:46
accessed their IT systems. Now, usually you hear
1:50
about these things weeks later, but this seemed
1:51
immediate. The response described in the sources
1:54
was incredibly drastic. I call it the nuclear
1:56
option. The nuclear option, you mean because
1:58
of how they reacted? Essentially, yes. Dr. Marsh
2:00
stated that they shut down all servers and disabled
2:03
all accounts. Everything. They even postponed
2:06
non -essential online events. But isn't that...
2:09
Isn't that overkill? I mean, shutting down the
2:12
entire school's digital infrastructure email,
2:15
learning platforms, admin records for a breach
2:18
that paralyzes the institution. It does. And
2:22
it is a controversial move. But think about it
2:24
from a containment perspective. In a ransomware
2:26
scenario or an active intrusion, the fog of war
2:29
is real. If you don't know exactly which account
2:32
is compromised or which server is patient zero,
2:35
you have to assume they all are until proven
2:37
otherwise. Sometimes the only way to stop the
2:40
bleeding is to stop the heart. That is a terrifying
2:43
thought. And they immediately engaged the Australian
2:45
Cybersecurity Center and forensic experts, which
2:48
is standard procedure. But the disruption must
2:50
have been massive. And the stakes here are incredibly
2:53
high. We aren't just talking about grade eight
2:55
math homework or, you know, the cafeteria menu.
2:58
The sources point out that the breach exposed
2:59
records of old Scotch collegians and families.
3:02
Right. I saw the list of alumni mentioned. We're
3:04
talking about people like Jeff Kennett, the former
3:06
Victorian premier. Andrew Holmes, former president
3:09
of the Australian Academy of Science. Kenneth
3:11
Hain, a former high court judge. Exactly. This
3:13
isn't just student data. It's a trove of information
3:16
on some of Australia's most influential families.
3:19
If you are a threat actor, that is leverage.
3:22
That is high value data. So why are schools such
3:25
targets? Peter A. Clark had an interest. interesting
3:27
take on this in his article. He mentioned that
3:29
schools often have hallowed halls, but basic
3:33
IT maintenance. It is a systemic contradiction.
3:37
Clark points out that schools are entrepots.
3:39
They have numerous entry points. You have hundreds
3:41
of new students joining every year, others leaving,
3:44
parents needing access, contractors coming in.
3:46
The authorizations are constantly changing. It
3:49
sounds like a logistical nightmare to secure.
3:51
It is. And unlike a bank, which is a fortress
3:53
by design, a school is designed for sharing and
3:56
openness. Plus, they are often running legacy
3:59
systems, old servers, outdated software with
4:02
inbuilt weaknesses that modern hackers can exploit
4:04
in minutes. It's the classic. link problem. You
4:07
can have great gates at the front of the school,
4:09
but if the digital back door is held open by
4:11
an old server, you're in trouble. And looking
4:14
at the sources, Scotch College wasn't an isolated
4:16
case, was it? Not at all. If we zoom out and
4:19
look at the trend analysis provided by Weber
4:21
Insurance Services, the picture gets much darker.
4:25
The education sector is being hammered. I was
4:28
looking at that list and it is startling. August
4:30
2025 was a bad month, generally. INET and Tassie
4:34
Aged Care got hit, too. But the education pattern
4:36
is undeniable. Just look at the precedent. December
4:39
2024, Waverly Christian College gets hit by the
4:42
Fogg Ransomware Group. They stole 5GB of data.
4:46
And then in April 2025, Western Sydney University
4:50
has 10 ,000 students impacted. Now, that wouldn't
4:54
surprise me. You'd think a university with all
4:56
its research grants and tech departments would
4:58
be harder to crack than a high school. You would
5:00
think so, but it goes back to that entrepot concept.
5:03
Universities have even more transient populations
5:05
and often even older legacy systems buried in
5:08
research departments. It forces the question,
5:10
if these breaches are happening left and right,
5:12
are these schools just being careless or is the
5:14
bar set too high? Well, surely there are rules
5:16
they have to follow. They can't just operate
5:18
on a handshake agreement regarding our data.
5:20
That is where it gets fascinating. We have access
5:23
to the Privacy Compliance Manual produced by
5:25
Independent Schools Australia and the Catholic
5:28
Education Commission. This is the rulebook. I
5:30
have to say, reading this manual was a bit of
5:33
an eye -opener. You assume there are rules, but
5:35
seeing them written down, they are incredibly
5:38
strict. They are. The manual is built around
5:41
the Australian Privacy Principles, or APPs, specifically
5:44
APP11, which covers data security. Right. And
5:48
the core phrase there is reasonable steps. Schools
5:52
must take reasonable steps to protect information
5:54
from misuse, interference, and loss. But reasonable
5:58
feels vague. What does the manual actually require
6:01
when it comes to, say, getting rid of data? The
6:04
destruction standards are surprisingly specific.
6:06
It's not enough to just scrunch up a piece of
6:08
paper and throw it in the bin. The manual literally
6:10
specifies shredding, pulping, or disintegration.
6:14
Disintegration? Yeah. That sounds like something
6:15
out of a spy movie. I need this report disintegrated
6:17
immediately. It does sound intense, but it highlights
6:20
the standard. If a document can be pieced back
6:23
together, it hasn't been destroyed. And for electronic
6:26
data, it says it must be put beyond use. What
6:29
does beyond use actually mean in IT terms? It
6:32
is a critical definition. Beyond use means the
6:36
school cannot access it. They cannot give anyone
6:38
else access. And crucially, they must have audit
6:41
trails proving it was destroyed. You can't just
6:44
hit delete and hope for the best. If you can
6:46
recover it from a recycle bin or a backup tape,
6:48
it's not. beyond use. This is like a high bar
6:51
for a school IT admin who might also be teaching
6:54
a math class. And then there's the cloud. This
6:57
is where I got a bit confused and I'm hoping
6:59
you can clarify. The manual has a whole section
7:01
part D discussing Google Apps for Education and
7:04
Office 356. Yes, this is a very nuanced area,
7:07
but it's vital for understanding liability. The
7:10
manual debates whether using a service like Google
7:13
Drive, where servers might be overseas, constitutes
7:15
a disclosure of data or just a use of data. Why
7:18
does that distinction matter? Is it just semantics?
7:20
It is a massive legal distinction. Think about
7:23
it. If you disclose data to a server in California,
7:27
you are technically handing over control to a
7:30
foreign entity. That triggers APP aid, meaning
7:33
the school is responsible if that U .S. company
7:36
breaches Australian privacy laws. It's a liability
7:39
nightmare. Right. So if Google messes up, the
7:41
school's on the hook. Exactly. But the manual
7:43
offers an escape hatch. If the contract explicitly
7:46
says the vendor can only store the data, no mining
7:49
for ads, no AI training, no accessing it for
7:52
their own purposes, then it's treated as use,
7:55
not disclosure. It keeps the data technically
7:58
within the school's control, even if the hard
8:00
drive is physically in San Francisco. So it's
8:02
all about the contract language. Precisely. But
8:04
the takeaway for parents and listeners is that
8:06
schools are warned to check where those servers
8:08
are. Often they are overseas. And the manual
8:11
explicitly says schools should update their privacy
8:13
policies to warn parents that their child's essay
8:15
or their medical record might be sitting on a
8:18
server in Singapore or the U .S. That is wild.
8:21
You just assume your kid's work stays in the
8:23
classroom, or at least in the country. So we
8:25
have the breach and we have these complex rules.
8:28
But what happens when the worst case scenario
8:30
actually hits? The manual has a data breach response
8:34
plan template. It does. And looking at the Scotch
8:37
College response, they seemingly followed the
8:39
textbook approach. The manual outlines mandatory
8:42
steps. Step one, contain. That's the pull the
8:45
plug move we saw. Exactly. Step two is assess.
8:47
The team has to determine if the breach is what's
8:50
called an eligible data breach or EDB. And this
8:53
leads to the serious harm test. This part really
8:56
stood out to me because it defines harm much
8:59
more broadly than I expected. It is the most
9:02
human part of the compliance manual. The school
9:04
has to evaluate if the breach could cause physical,
9:07
psychological, emotional, financial or reputational
9:10
harm. Emotional and psychological harm. I think
9:13
we often forget that. We worry about credit cards.
9:15
But for a student having behavioral records,
9:18
counseling notes or family court orders leaked,
9:20
it's devastating. Absolutely. The manual actually
9:23
lists risk factors in annexure three, it asks.
9:26
Who is affected? Is it students? Is it contractors?
9:29
And crucially. Is the info intelligible? Right.
9:32
Is it encrypted or is it just plain text? There
9:35
was an interesting detail in the manual about
9:37
considering if the data is protected by a security
9:40
measure. And this is key, how likely it is that
9:43
the hackers can circumvent it. Which brings us
9:45
to the reality check. Because you can have this
9:47
pristine 160 -page manual demanding military
9:50
-grade encryption and disintegration of documents.
9:53
But then you walk into the server room or the
9:55
staff room, and the reality is very different.
9:58
There's a huge gap between the policy and the
10:00
practice. And actually, we saw this play out
10:02
in real time on a Reddit thread discussing these
10:04
Victorian breaches. The users there, mostly IT
10:08
admins and students, weren't quoting compliance
10:11
manuals. They were talking about the messy reality
10:13
of school IT. The community reaction is always
10:16
a good barometer. You had users like CubeZera
10:18
commenting on consultancy bonuses. Yeah, that
10:20
comment stung. Basically saying organizations
10:23
won't admit fault because they don't want the
10:25
vendor to sue them. So instead, they hire consultants,
10:28
everyone pats themselves on the back, and the
10:30
hackers walk away with the data. There is a pervasive
10:32
feeling that big companies and the government
10:34
simply aren't doing enough. One user noted they
10:38
use these breaches as a lesson to their kids
10:40
that none of their info is safe online. It's
10:44
a sad lesson to have to teach. But there was
10:46
a specific technical debate in that thread that
10:49
I want to drill into. It was about passwords.
10:51
Users Sep Underpants and Appealing Genitals,
10:55
classic Reddit usernames, were arguing about
10:59
hashing and salting. Yes, the usernames are colorful,
11:02
but the advice is actually very sound. This is
11:05
a concept everyone should understand because
11:07
it explains why some breaches are catastrophic
11:08
and others aren't. So break it down for us. Most
11:10
people have heard of hashing. That's scrambling
11:12
the password, right? Correct. Imagine you have
11:15
a password, say bluey123. You don't want to store
11:19
that as plain text in your database. So you run
11:22
it through a mathematical algorithm, a hash function.
11:24
It turns blue123 into a long, scrambled string
11:27
of characters, like that SHA3 example in the
11:29
source, 32459, and so on. Okay, so it's scrambled.
11:34
That sounds secure. If a hacker steals the database,
11:37
they just see gobbledygook. It used to be secure.
11:39
But computers are fast now. Hackers have what
11:42
are called rainbow tables. These are massive
11:45
pre -computed lists of millions of common passwords
11:47
and their corresponding hash strings. So if they
11:50
see that specific scrambled string in the stolen
11:52
database, they can just look it up on their table
11:54
and see that it equals bluey123. Exactly. It's
11:57
like a reverse phone book. If you just use simple
11:59
hashing, your password is cracked in milliseconds.
12:01
And that is where salting comes in. The Reddit
12:03
users were adamant about this. Yes. Salting is
12:06
the antidote to rainbow tables. Salting means
12:09
adding a random string of unique data, the salt,
12:12
to the password before you scramble it. So for
12:14
student A, you might add x7z to bluey123 and
12:18
scramble that combined string. For student B,
12:20
you add 9qp to bluey123 and scramble that. So
12:24
even though they have the same password, the
12:26
result in the database looks completely different.
12:28
Precisely. And because every user has a unique
12:31
salt, The hacker's rainbow tables are useless.
12:34
They would have to recalculate the hash for every
12:36
single user individually. It turns a job that
12:39
takes seconds into a job that could take centuries.
12:42
It seems like such a basic step. Why isn't everyone
12:44
doing it? Complexity, legacy systems, laziness,
12:47
it varies. But the impact is real. There was
12:50
that anecdote from the IT manager on Reddit who
12:52
ran a have I been proud session for staff. Dow
12:55
was telling. They asked staff to check their
12:58
emails against the database of known breaches.
13:00
Only three staff members out of the whole group
13:02
hadn't suffered a breach. Only three. It really
13:05
highlights how prevalent reused passwords are.
13:08
If one site gets breached, say a shopping site
13:11
you used five years ago, and you haven't salted
13:13
your passwords or you reuse that password at
13:16
school, the school is vulnerable. It connects
13:19
everything back together. The hallowed halls,
13:21
Clark mentioned, are being protected by people
13:23
who are likely reusing passwords that were compromised
13:26
in a completely different hack years ago. It
13:29
creates a massive surface area for attack. So
13:32
let's bring this all together. We've seen the
13:33
Scotch College headline, which is scary. We've
13:36
seen that it's part of a massive trend attacking
13:38
the education sector. We've looked at the strict
13:41
rules, shredding, pulping, serious harm tests
13:44
that schools should be following. And we've learned
13:47
that technical basics like salting passwords.
13:50
really matter. I think the biggest takeaway is
13:52
the disconnect. We have incredibly sophisticated
13:54
compliance manuals. The privacy compliance manual
13:57
is thorough. It covers everything from cloud
13:59
servers to emotional harm. But the reality on
14:02
the ground, as seen in the Reddit comments and
14:04
the sheer volume of breaches, is that implementation
14:06
is lagging. It feels like a race, doesn't it?
14:09
The hackers are sprinting and the schools are
14:11
trying to run with a 160 -page manual strapped
14:14
to their backs. That's a good analogy. And we
14:17
have to remember, schools hold the most sensitive
14:20
data of our lives. We aren't just talking about
14:22
credit cards. We are talking about medical records,
14:25
behavioral reports, family court orders, learning
14:28
disabilities. That brings us back to the serious
14:31
harm test we discussed. It does. Compliance isn't
14:34
just paperwork or ticking a box to avoid a fine.
14:37
It isn't just about avoiding a headline. It's
14:40
about protecting vulnerable people children from
14:43
real world harm. When a school's data is breached,
14:46
it's a breach of trust that can last a lifetime.
14:49
That is a heavy thought, but an important one.
14:51
We need to move beyond just reading the headlines
14:53
and start asking the hard questions about how
14:55
that data is actually being guarded. Absolutely.
14:58
It really highlights that data security isn't
15:01
a set -and -forget document. It's an active,
15:03
daily, defensive posture. And that is a hard
15:07
standard to maintain alone. Whether you're running
15:09
a school with thousands of students or a business
15:11
with sensitive IP, the gap between your manual
15:14
and your server room is where the risk lives.
15:16
If you need help closing that gap, or you just
15:19
want a security audit that goes deeper than a
15:21
checklist, go to www .kinsoft .com .au. They
15:25
can help you bridge that gap between the manual
15:27
and reality. Exactly. Check them out at www .kinsoft
15:31
.com .au to discuss your security and IT needs.
15:35
Thanks for listening to Tech Talks with Kinsoft.
15:37
Stay safe out there, and we'll catch you next
15:39
time.