WEBVTT - Is your super safe from hackers?  

0:00:05.200 --> 0:00:08.039
<v Speaker 1>From The Australian. Here's what's on the front. I'm Claire Harvey.

0:00:08.119 --> 0:00:13.960
<v Speaker 1>It's Wednesday, April nineth, twenty twenty five, and for now

0:00:14.000 --> 0:00:16.600
<v Speaker 1>Benezi and Peter Dutton have faced off in the first

0:00:16.720 --> 0:00:21.640
<v Speaker 1>debate of this election campaign, a clash that inevitably turned fiery.

0:00:22.480 --> 0:00:25.720
<v Speaker 2>In the twenty fourteen budget, thirty b and dollars was

0:00:25.760 --> 0:00:29.080
<v Speaker 2>repped out of public schools. In that budget, fifty b

0:00:29.200 --> 0:00:32.239
<v Speaker 2>and dollars was repped out of hospitals. That is not

0:00:32.360 --> 0:00:37.000
<v Speaker 2>the factually correct statement. It's misleading, it's designed to scare people,

0:00:37.360 --> 0:00:39.400
<v Speaker 2>and I think it's dishonest from a man who wants

0:00:39.440 --> 0:00:42.280
<v Speaker 2>to be re elected as the Prime minister of our country.

0:00:42.840 --> 0:00:45.920
<v Speaker 2>In forty years, there has not been a higher spending

0:00:45.960 --> 0:00:47.880
<v Speaker 2>government than your government. Is that correct?

0:00:47.960 --> 0:00:49.680
<v Speaker 3>Well, that's not true, except for the one that you

0:00:49.720 --> 0:00:50.400
<v Speaker 3>were a part of.

0:00:52.320 --> 0:00:56.480
<v Speaker 1>The Greens are pitching their campaign at Australia's seven million renters,

0:00:56.800 --> 0:00:59.280
<v Speaker 1>with leader Adam Bandt at the Press Club on Wednesday

0:00:59.520 --> 0:01:03.000
<v Speaker 1>to demand capital gains, tax breaks and negative gearing be

0:01:03.240 --> 0:01:08.520
<v Speaker 1>axed and a freeze on rent increases. All the latest

0:01:08.600 --> 0:01:12.360
<v Speaker 1>from the campaign and our experts analysis is live now

0:01:12.440 --> 0:01:17.840
<v Speaker 1>at the Australian dot com dot au. Australian super has

0:01:18.040 --> 0:01:21.200
<v Speaker 1>finally called in the police to investigate a hack that

0:01:21.360 --> 0:01:25.119
<v Speaker 1>saw four hundred and six thousand dollars drained from an

0:01:25.160 --> 0:01:30.119
<v Speaker 1>elderly customer's superannuation account. But the scandal has revealed huge

0:01:30.200 --> 0:01:34.520
<v Speaker 1>holes in superfund's ability to keep our money away from criminals,

0:01:34.959 --> 0:01:37.640
<v Speaker 1>or even to allow us to log into their websites

0:01:37.720 --> 0:01:41.160
<v Speaker 1>to find out how much money we have left today?

0:01:41.600 --> 0:01:50.279
<v Speaker 1>Is our money safe in super? Towards the end of March,

0:01:50.320 --> 0:01:54.120
<v Speaker 1>a seventy four year old Queensland woman received some correspondence

0:01:54.200 --> 0:01:59.440
<v Speaker 1>from her superannuation fund. We'll call her Joan. Australian super

0:01:59.560 --> 0:02:03.360
<v Speaker 1>was writing to Joan, it said, to confirm withdrawals made

0:02:03.360 --> 0:02:07.920
<v Speaker 1>from her account a week earlier. That's odd, Joan hadn't

0:02:08.000 --> 0:02:11.640
<v Speaker 1>made any withdrawals, much less for one hundred thousand dollars

0:02:11.720 --> 0:02:15.640
<v Speaker 1>at a time, and it wasn't just one. Joan realized

0:02:15.680 --> 0:02:19.720
<v Speaker 1>with increasing horror that six withdrawals totaling four hundred and

0:02:19.800 --> 0:02:23.480
<v Speaker 1>six thousand dollars had been made from her super over

0:02:23.480 --> 0:02:26.799
<v Speaker 1>the space of a week. When she alerted the superfund

0:02:26.840 --> 0:02:30.720
<v Speaker 1>to the fraud, she expected a swift response, but for

0:02:30.919 --> 0:02:35.679
<v Speaker 1>ten agonizing days. It was crickets. The fund failed to

0:02:35.760 --> 0:02:38.760
<v Speaker 1>raise the incident with the Commonwealth Bank and didn't commit

0:02:38.840 --> 0:02:42.639
<v Speaker 1>to covering the loss until The Australian's Business reporter Cleoner

0:02:42.639 --> 0:02:47.760
<v Speaker 1>O'Dowd started asking questions almost three weeks after the attack began.

0:02:48.639 --> 0:02:52.000
<v Speaker 1>And Joan's not the only one caught up in this mess.

0:02:53.880 --> 0:02:58.639
<v Speaker 4>Several Australian superannuation funds have been targeted by cyber criminals.

0:02:59.040 --> 0:03:03.600
<v Speaker 4>It's caused panic and frustration for thousands of members who've

0:03:03.600 --> 0:03:07.720
<v Speaker 4>been unable to check whether their nest egg has been impacted.

0:03:11.400 --> 0:03:15.160
<v Speaker 1>Jared Lynch is The Australian's Technology editor. The story of

0:03:15.320 --> 0:03:18.639
<v Speaker 1>Joan and her loss of four hundred and six thousand

0:03:18.639 --> 0:03:22.200
<v Speaker 1>dollars from her superfund is just staggering. And what does

0:03:22.240 --> 0:03:24.720
<v Speaker 1>that tell us about the safety of all of our funds.

0:03:25.840 --> 0:03:29.320
<v Speaker 3>It tells us that our safety is expendable and can

0:03:29.440 --> 0:03:33.760
<v Speaker 3>be cracked within seconds by anyone who's got the will

0:03:33.760 --> 0:03:35.960
<v Speaker 3>to be able to do that. How they've been able

0:03:36.000 --> 0:03:38.920
<v Speaker 3>to get in the hackers is that they've got a

0:03:38.920 --> 0:03:42.160
<v Speaker 3>heap of people's usernames. They've ever tried to get a

0:03:42.160 --> 0:03:44.920
<v Speaker 3>heap of passwords from the dark web, from previous breaches

0:03:45.040 --> 0:03:47.000
<v Speaker 3>or they have done what's called a brute force attack,

0:03:47.360 --> 0:03:50.480
<v Speaker 3>which is to keep guessing, scrambling, guessing until you're getting

0:03:50.560 --> 0:03:53.600
<v Speaker 3>through the door. And because there's no multi factor of

0:03:53.680 --> 0:03:57.640
<v Speaker 3>authentication which means you get a notification on your phone

0:03:57.720 --> 0:04:00.600
<v Speaker 3>or through a third party app to verify yourself, that

0:04:00.680 --> 0:04:02.720
<v Speaker 3>means that they can walk straight in through the door

0:04:03.040 --> 0:04:04.800
<v Speaker 3>and do what they like with your account.

0:04:06.400 --> 0:04:08.960
<v Speaker 1>How big is this jared compared to other hacks that

0:04:09.000 --> 0:04:12.120
<v Speaker 1>we've seen of major companies like, for example, OPTAs.

0:04:12.280 --> 0:04:15.720
<v Speaker 3>Australia super would love to compare it to OPTAs, saying

0:04:15.760 --> 0:04:17.880
<v Speaker 3>that well, they had the data of nine and a

0:04:17.880 --> 0:04:21.119
<v Speaker 3>half million Australian stolen. We've only had a very small

0:04:21.160 --> 0:04:23.800
<v Speaker 3>problem here and that of course has been the problem

0:04:23.800 --> 0:04:25.880
<v Speaker 3>with the super funds, which is why they've been so

0:04:26.080 --> 0:04:28.800
<v Speaker 3>laxed when it comes to cybersecurity. And I'm not saying this.

0:04:29.240 --> 0:04:32.240
<v Speaker 3>The Australian Securities and Investments Commission is saying this. They

0:04:32.320 --> 0:04:35.320
<v Speaker 3>set it back in January saying that your weak online

0:04:35.360 --> 0:04:39.240
<v Speaker 3>security is exposing your members to scams. Do something about it.

0:04:39.520 --> 0:04:42.919
<v Speaker 3>And rather than doing something about it, the Association of

0:04:42.960 --> 0:04:48.240
<v Speaker 3>Super Funds Off Australia CEO said, you're raising unnecessary alarm.

0:04:48.680 --> 0:04:52.240
<v Speaker 3>Super funds are the safest places in Australia to put

0:04:52.279 --> 0:04:56.160
<v Speaker 3>your money. So nothing happened and as a result we've

0:04:56.200 --> 0:04:59.640
<v Speaker 3>now seen this huge cyber attack because they thought, well

0:04:59.720 --> 0:05:02.920
<v Speaker 3>it's only a little problem. Well little problems can turn

0:05:03.360 --> 0:05:06.520
<v Speaker 3>into big problems. To paraphrase Paul Kelly, from little things,

0:05:06.520 --> 0:05:09.200
<v Speaker 3>big things grow and that is indeed what is happening.

0:05:11.560 --> 0:05:14.359
<v Speaker 1>Four super funds were targeted by cyber criminals in the

0:05:14.400 --> 0:05:20.279
<v Speaker 1>coordinated attack, Australian Super, Australian Retirement Trust HOST Plus and

0:05:20.520 --> 0:05:25.760
<v Speaker 1>REST the retail employee's superannuation trust. They manage almost a

0:05:25.880 --> 0:05:29.320
<v Speaker 1>trillion dollars in retirement savings on behalf of thousands of

0:05:29.360 --> 0:05:34.360
<v Speaker 1>Australians like Joan, who's one of four Australian supercustomers confirmed

0:05:34.440 --> 0:05:37.880
<v Speaker 1>to have lost money in the hack. Australian Super is

0:05:37.920 --> 0:05:40.960
<v Speaker 1>still combing through the six hundred accounts that were breached,

0:05:41.320 --> 0:05:46.000
<v Speaker 1>while other funds scramble to reassure their anxious customers.

0:05:47.839 --> 0:05:53.160
<v Speaker 5>No suspicious transactions or changes have been detected on member accounts.

0:05:53.600 --> 0:05:57.120
<v Speaker 2>We recognize how frustrating this can be and sincerely appreciate

0:05:57.160 --> 0:06:01.360
<v Speaker 2>your patience. An unusually high spe can log in attempts.

0:06:02.240 --> 0:06:04.480
<v Speaker 1>We are experiencing a high volume of calls to our

0:06:04.480 --> 0:06:07.680
<v Speaker 1>contact center, resulting in a longer than normal wait time.

0:06:09.160 --> 0:06:12.200
<v Speaker 1>So Jared, now we get to the mystery of why

0:06:12.279 --> 0:06:15.960
<v Speaker 1>police weren't involved right from the beginning. What are you

0:06:16.040 --> 0:06:19.680
<v Speaker 1>hearing now from Australian super about if or when the

0:06:19.680 --> 0:06:20.640
<v Speaker 1>police were called.

0:06:22.080 --> 0:06:24.560
<v Speaker 3>Well, the good news is that they have contact a

0:06:24.640 --> 0:06:27.080
<v Speaker 3>Metaday to say that we have reported it to the AFP.

0:06:27.240 --> 0:06:30.480
<v Speaker 3>Five days after the hackers struck they decided to call

0:06:30.520 --> 0:06:33.599
<v Speaker 3>in the coppers and that was only because probably that

0:06:33.680 --> 0:06:35.680
<v Speaker 3>we did a front page story saying they hadn't called

0:06:35.720 --> 0:06:39.000
<v Speaker 3>the AFP, who, of course, are the federal agency tasks

0:06:39.040 --> 0:06:42.880
<v Speaker 3>with investigating such crimes, because as we all know, they're

0:06:42.880 --> 0:06:44.919
<v Speaker 3>the ones that we're able to track down the Russian

0:06:44.960 --> 0:06:47.760
<v Speaker 3>hacker that was responsible for the medibank attack back in

0:06:47.839 --> 0:06:48.520
<v Speaker 3>late twenty two.

0:06:49.839 --> 0:06:54.479
<v Speaker 5>The AFP is undertaking covert measures and working around the

0:06:54.480 --> 0:06:59.359
<v Speaker 5>clock with our domestic agencies and our international networks, including

0:06:59.400 --> 0:07:04.840
<v Speaker 5>into POL. This is important because we believe those responsible

0:07:04.880 --> 0:07:08.760
<v Speaker 5>for the breach are in Russia.

0:07:08.960 --> 0:07:10.880
<v Speaker 3>Super funds, a lot of them, not all of them,

0:07:10.880 --> 0:07:13.080
<v Speaker 3>but a lot of them are regulated by the Australian

0:07:13.080 --> 0:07:18.240
<v Speaker 3>Prudential Regulatory Authority, and when these sort of hacks happen,

0:07:18.880 --> 0:07:21.600
<v Speaker 3>APROA do a review and if they have found that

0:07:21.680 --> 0:07:26.160
<v Speaker 3>your cyber defenses are inadequate or weak, then they can

0:07:26.200 --> 0:07:28.640
<v Speaker 3>impose pretty harsh penalties, which is what they did with

0:07:28.720 --> 0:07:32.360
<v Speaker 3>Medibank after their attack, and the same thing can happen here.

0:07:32.960 --> 0:07:35.840
<v Speaker 3>The problem is we don't know what that is until

0:07:35.840 --> 0:07:39.360
<v Speaker 3>probably potentially weeks or even months after the event, until

0:07:40.000 --> 0:07:43.000
<v Speaker 3>the forensic analysis has been done. APRA comes in and

0:07:43.040 --> 0:07:46.480
<v Speaker 3>does their investigation, and all that is very poor comfort

0:07:46.480 --> 0:07:49.400
<v Speaker 3>to members who the reason why they're with an industry

0:07:49.440 --> 0:07:51.800
<v Speaker 3>super fun to begin with is they're there to profit members,

0:07:51.840 --> 0:07:55.960
<v Speaker 3>not themselves, and any fines are taken from the member's

0:07:56.040 --> 0:07:58.240
<v Speaker 3>pot of money. So they're up in arms say, well,

0:07:58.400 --> 0:08:01.120
<v Speaker 3>what point is it to find the super funds. That's

0:08:01.160 --> 0:08:04.000
<v Speaker 3>my money that you're taking away, and I've already been

0:08:04.320 --> 0:08:06.840
<v Speaker 3>hit with this cyber attack, so it's almost like punishing

0:08:06.880 --> 0:08:07.880
<v Speaker 3>the victims of crime.

0:08:08.680 --> 0:08:11.440
<v Speaker 1>The other big threat to Australian superbalances right now is

0:08:11.520 --> 0:08:15.360
<v Speaker 1>Donald Trump and his Liberation Day tariffs, which are draining

0:08:15.400 --> 0:08:18.680
<v Speaker 1>money out of all our superbalances day to day. That's

0:08:18.800 --> 0:08:22.200
<v Speaker 1>why hundreds of thousands of Australians are wanting to log

0:08:22.280 --> 0:08:25.200
<v Speaker 1>on and look at their superbalances to see what's going on,

0:08:25.320 --> 0:08:28.240
<v Speaker 1>to see how much money they've got left. Should the

0:08:28.240 --> 0:08:31.960
<v Speaker 1>funds have to be able to deal with that kind

0:08:32.000 --> 0:08:34.720
<v Speaker 1>of volume, Jared, Surely it's not out of the realm

0:08:34.720 --> 0:08:38.120
<v Speaker 1>of consideration that everybody would want to log on all

0:08:38.160 --> 0:08:39.679
<v Speaker 1>on the one day to see if their money is

0:08:39.679 --> 0:08:40.120
<v Speaker 1>still there.

0:08:40.400 --> 0:08:43.520
<v Speaker 3>You're absolutely spot on there if they're providing a service

0:08:43.520 --> 0:08:45.320
<v Speaker 3>and they've got to make sure people access it. And

0:08:45.320 --> 0:08:48.440
<v Speaker 3>when you look at a massive geopolitical event which is

0:08:48.480 --> 0:08:53.120
<v Speaker 3>causing considerable anxiety, particularly as you approach preservation age where

0:08:53.160 --> 0:08:55.680
<v Speaker 3>you're about to draw down on that super naturally you

0:08:55.760 --> 0:08:58.320
<v Speaker 3>are going to want to check out what your balances

0:08:58.360 --> 0:09:02.679
<v Speaker 3>are etc. Also, the closer you are to preservation age,

0:09:03.160 --> 0:09:06.880
<v Speaker 3>the more vulnerable you are to scams because you're wanting

0:09:06.960 --> 0:09:09.520
<v Speaker 3>to go in logging, work out how you're going to

0:09:09.600 --> 0:09:12.000
<v Speaker 3>manage your money, etc. And that was one of the

0:09:12.040 --> 0:09:17.480
<v Speaker 3>things Acid called out that super trustees had no way

0:09:17.520 --> 0:09:22.800
<v Speaker 3>of knowing whether someone who was approaching preservation age was

0:09:22.880 --> 0:09:25.480
<v Speaker 3>being tricked and a victim of a scam. And that

0:09:25.600 --> 0:09:28.120
<v Speaker 3>was one thing that Acid called out back in January

0:09:28.559 --> 0:09:32.920
<v Speaker 3>and which their lobby group said they're be an alarmist.

0:09:33.000 --> 0:09:34.960
<v Speaker 3>There's nothing to see here. More or less.

0:09:38.240 --> 0:09:41.520
<v Speaker 1>Coming up, the super fun say they're the safest place

0:09:41.600 --> 0:10:02.800
<v Speaker 1>in the world to keep your money. Does that stack up, Jared?

0:10:02.960 --> 0:10:06.760
<v Speaker 1>Because they have so much of Australian's money under management.

0:10:06.880 --> 0:10:10.559
<v Speaker 1>Super funds are incredibly powerful as forces in our society

0:10:10.800 --> 0:10:13.760
<v Speaker 1>in terms of what they do or don't invest in,

0:10:14.160 --> 0:10:17.360
<v Speaker 1>what values they expect companies to uphold, if they're going

0:10:17.720 --> 0:10:21.199
<v Speaker 1>to give them our money. What are we seeing do

0:10:21.280 --> 0:10:24.160
<v Speaker 1>you think in the balance of the way super funds

0:10:24.160 --> 0:10:26.880
<v Speaker 1>themselves operate and expect others to operate.

0:10:27.840 --> 0:10:30.840
<v Speaker 3>So it's very much do as I say, not as

0:10:31.200 --> 0:10:34.439
<v Speaker 3>do as I do. And one of the reasons why

0:10:34.480 --> 0:10:38.520
<v Speaker 3>we haven't seen this big diversity, equity and inclusion pushback

0:10:39.000 --> 0:10:41.880
<v Speaker 3>that we've seen happen in the US is because of

0:10:42.080 --> 0:10:45.480
<v Speaker 3>Australia's super funds. Because they sit on about four trillion

0:10:45.520 --> 0:10:49.200
<v Speaker 3>dollars worth of savings and use their enormous clout to

0:10:49.280 --> 0:10:52.960
<v Speaker 3>push their own agenda onto Australia's top companies. That's just

0:10:53.000 --> 0:10:55.719
<v Speaker 3>a reality. They're sitting on the biggest pot of retirement

0:10:55.720 --> 0:10:58.240
<v Speaker 3>savings in the country and they're not afraid to flex

0:10:58.280 --> 0:11:02.520
<v Speaker 3>that financial muscle, but when it comes to their own house,

0:11:02.600 --> 0:11:05.160
<v Speaker 3>it's an absolute mess. They're saying it is one of

0:11:05.200 --> 0:11:07.360
<v Speaker 3>the safest places in the country where you can park

0:11:07.480 --> 0:11:10.280
<v Speaker 3>your money, and that is true, but what we've seen

0:11:10.559 --> 0:11:14.400
<v Speaker 3>is their corporate governance is wanting. They are a soft target.

0:11:14.720 --> 0:11:17.880
<v Speaker 3>They're sitting on trillions of dollars worth of retirement savings.

0:11:17.880 --> 0:11:20.840
<v Speaker 3>That is a huge honeypot for hackers. And if they

0:11:20.880 --> 0:11:24.000
<v Speaker 3>don't clean up their shop, make sure that they adopt

0:11:24.000 --> 0:11:26.640
<v Speaker 3>the same level of governance that they demand from the

0:11:26.760 --> 0:11:31.679
<v Speaker 3>likes of Wistech and other Australian companies, then our retirement

0:11:31.720 --> 0:11:35.160
<v Speaker 3>savings are at risk to these sort of data breaches, attacks,

0:11:36.040 --> 0:11:38.120
<v Speaker 3>you name it. They got to clean up their act.

0:11:40.080 --> 0:11:46.360
<v Speaker 1>Jared Lynch is The Australian's Technology editor. You can read

0:11:46.400 --> 0:11:49.560
<v Speaker 1>all our reporting on this hack and on the superannuation

0:11:49.679 --> 0:12:05.319
<v Speaker 1>sector right now at the Australian dot com dot au