Speaker 1: Already and this is this is the Daily h this
Speaker 1: is the Daily OAHs. Oh now it makes sense.
Speaker 2: Good morning, and welcome to the Daily Odds. It's Tuesday,
Speaker 2: the fourteenth of October. I'm Elliott, Lorie.
Speaker 1: I'm Billy good.
Speaker 2: Simon's names, phone numbers, and email addresses were just some
Speaker 2: of the personal data points compromise during a hacking scandal
Speaker 2: that first hick Quantas back in July. Fast forward to
Speaker 2: this week and things have escalated, with the hackers behind
Speaker 2: the attack leaking that data on the dark web. On
Speaker 2: today's podcast, we're breaking down exactly what happened, how the
Speaker 2: hackers got in, who was behind the attack, and what
Speaker 2: Quantus customers can do to protect themselves.
Speaker 1: Elliott, there were so many headlines about Quantus and this
Speaker 1: data leak over the weekend. Where did this story all begin?
Speaker 1: Because I remember this coming up a few months ago.
Speaker 2: Now, Yeah, this story's been kicking around for quite a
Speaker 2: while now. It actually first came up in July. That
Speaker 2: was when we first heard from Quantus that they had
Speaker 2: detected a breach at one of their third party call
Speaker 2: centers and they were working to contain that breach. As
Speaker 2: part of the statement that they first put out, they
Speaker 2: revealed that the data of up to six million Quantus
Speaker 2: customers had been compromised. That's a lot. It's a very
Speaker 2: big number. Now, when I say compromised, we're talking about
Speaker 2: things like names, email addresses, phone numbers, birth dates, and
Speaker 2: frequent flyer numbers. Importantly, Quantus said that things like passports,
Speaker 2: credit card details, account passwords and pins, you know that
Speaker 2: really sensitive information that was not part of the breach.
Speaker 2: And Quantus responded by obtaining a permanent injunction from the
Speaker 2: Supreme Court of New South Wales to prevent use or
Speaker 2: further publication of the stolen data. So this basically made
Speaker 2: it illegal to spread any of the information publicly, but
Speaker 2: it doesn't erase the fact that the data is already
Speaker 2: out there.
Speaker 1: When I was reading about this over the weekend, one
Speaker 1: of the things that I was really interested to learn
Speaker 1: is actually how hackers got this information, because it wasn't
Speaker 1: just through them going into the computer systems. What can
Speaker 1: you tell us about that?
Speaker 2: Yeah, A little peak behind the TDA curtain is that
Speaker 2: when we put stories in the morning, it's often hard
Speaker 2: to get Billy up and excited about what we're talking about.
Speaker 2: That's not true this morning. You were especially excited about
Speaker 2: this story.
Speaker 1: I was because of how they got this information. I
Speaker 1: find it so interesting.
Speaker 2: It is interesting, I'll give you that. So basically it
Speaker 2: wasn't a direct breach of Quantuss systems, but rather they
Speaker 2: got the information from a platform called Salesforce. So I'm
Speaker 2: sure quite a few of our listeners would be familiar
Speaker 2: with Salesforce, at least they would have heard the name. Maybe.
Speaker 2: It's basically a really popular tool that's used by a
Speaker 2: lot of companies around the world to help with managing
Speaker 2: customer relationships. That's kind of the primary function, but it
Speaker 2: also can be used for marketing and sales and a
Speaker 2: bunch of other things that help the business go around. Now,
Speaker 2: at least forty major companies from around the world who
Speaker 2: used Salesforce were caught up in this attack, So we're
Speaker 2: talking about some pretty big names here. Think of Toyota, Disney, McDonald's, Aquia,
Speaker 2: and of course Quantus. Yes, so basically Salesforce holds all
Speaker 2: of these companies customer data, and in the case of Quantus,
Speaker 2: it's understood the hackers retrieve the information from a call
Speaker 2: center in the Philippines.
Speaker 1: And that's what's so interesting. That they called this call
Speaker 1: center and kind of convince them to hand over the
Speaker 1: data by posing as an employee.
Speaker 2: Yeah, that's exactly what happens. So they pretended to be
Speaker 2: a Quantus employee. In this instance, they actually use AI
Speaker 2: to modify their voice and make themselves more recognizable to
Speaker 2: the person on the other end of the line, and
Speaker 2: they were able to convince someone in that call center
Speaker 2: to grant them access to the database. Now, this is
Speaker 2: becoming an increasingly popular method for hackers if you think
Speaker 2: about it. You know, most companies these days, they're really
Speaker 2: bolstering up their cybersecurity efforts, so it's harder and harder
Speaker 2: to attack in the traditional ways. So they're actually using
Speaker 2: humans as kind of the weak points in companies to
Speaker 2: make their way in.
Speaker 1: So basically, the tech is becoming so air tight that
Speaker 1: the way they obviously humans make errors and so that's
Speaker 1: how they're seeing as their way in.
Speaker 2: Yeah, and in this case, that is how they launched
Speaker 2: this attack. So essentially, they were able to speak to
Speaker 2: someone who had the right access for Salesforce, and they
Speaker 2: were able to convince them to install a fake integration
Speaker 2: with Salesforce that basically was a key for the hackers
Speaker 2: to access the data that was stored on Salesforce at the.
Speaker 1: Time got it and so that was back in July,
Speaker 1: tell us why we're talking about it today.
Speaker 2: So last week we were actually made aware of a
Speaker 2: post on the hackers' website that contained a sample of
Speaker 2: the data that they'd stolen from those forty companies.
Speaker 1: Around the world, kind of like a teaser, a.
Speaker 2: Teaser exactly, a very dark cliber teaser. As part of
Speaker 2: that post, the hackers told Salesforce that they would have
Speaker 2: to pay a ransom on behalf of the companies or
Speaker 2: risk having the rest of the data leaked on the internet.
Speaker 2: Needless to say, they didn't cough up the money, and
Speaker 2: a Salesforce spokesperson told Titia that they quote will not engage,
Speaker 2: negotiate with, or pay any extortion demand. And on Saturday,
Speaker 2: the data from Quantus at least was leaked. On that
Speaker 2: same day, the hackers posted saying quote don't be the
Speaker 2: next headline, should have paid the ransom.
Speaker 1: WOWE interesting statement from them. I always find it interesting
Speaker 1: whenever we have these conversations about cyber leaks and ransoms
Speaker 1: that the general principle is for these companies to never
Speaker 1: pay ransoms. What is the kind of logic behind that.
Speaker 2: Yeah, I think it is an interesting one because you'd
Speaker 2: sort of see all these headlines and think, why didn't
Speaker 2: they just paid? It would be so much easier. But
Speaker 2: paying ransoms is generally discouraged by cybersecurity experts, and that's
Speaker 2: because while it might make a problem in the moment
Speaker 2: go away, so maybe this startup wouldn't have got leaked,
Speaker 2: at the end of the day, you're still paying cyber criminals,
Speaker 2: so you're effectively financing the next hack. You're paying for
Speaker 2: them to have more resources and more capabilities, And on
Speaker 2: top of that, it also puts your company in a
Speaker 2: vulnerable position because the hackers now know that you're or
Speaker 2: willing to pay up.
Speaker 1: It's about the precedent that it sets as well.
Speaker 2: Yeah, exactly. Now, there's also no guarantee that they won't
Speaker 2: leak the data anyway or use it for other purposes,
Speaker 2: because at the end of the day, we are talking
Speaker 2: about negotiating with criminals here, so they're not kind of
Speaker 2: bound under laws of a traditional agreement where you'd be
Speaker 2: paying money for someone to stop doing something. Now, there
Speaker 2: are some small situations where a company might choose to
Speaker 2: pay ransom, and that's often when hackers have extremely sensitive
Speaker 2: information and you know, they're willing to do basically whatever
Speaker 2: to make sure that the threat is contained.
Speaker 1: And what do we know about the hackers in this case?
Speaker 2: This is actually really interesting. I think we should do
Speaker 2: a whole nother podcast on this, okay, But the sort
Speaker 2: of short version of it is that the hackers in
Speaker 2: this scenario go by the name of Scattered Lapsus Hunters,
Speaker 2: which I won't say again, so we're going to call
Speaker 2: them SLSH. Okay. Moving forward, now, you can kind of
Speaker 2: think of them as like a supergroup that's made up
Speaker 2: of some of the world's most notorious cyber criminals. It's
Speaker 2: understood that the members of SLSH are mainly young native
Speaker 2: English speakers from the US and the UK, some in
Speaker 2: Australia as well, and there's been reports that some of
Speaker 2: them are as young as sixteen years old, so being
Speaker 2: sort of brought into this world very young. Now. The
Speaker 2: people on the STEAM have been responsible for some pretty
Speaker 2: high profile cyber crime incidents, including a ransomware attack on
Speaker 2: MGM Resorts that you might remember that was back in
Speaker 2: twenty twenty three, and that attack cost the company one
Speaker 2: hundred million US dollars just to get the computer systems
Speaker 2: back online.
Speaker 1: Wow.
Speaker 2: Now, one thing that we've kind of brushed over in
Speaker 2: this conversation is that even though we are focusing on Quantus,
Speaker 2: this is affecting, you know, at least forty global companies.
Speaker 2: Quantus was just the biggest Australian one, which is why
Speaker 2: we're talking about it today. It affects the people listening
Speaker 2: to this podcast. But it was a global response to
Speaker 2: this leak. So notably the FBI in the US, they
Speaker 2: were the ones who on the weekend stepped in and
Speaker 2: actually seized the domain that the data was published on,
Speaker 2: and they shut down on the hacker's website. As Lsh
Speaker 2: then took to the social media platform Telegram to say,
Speaker 2: seizing a domain does not really affect our operations. FBI
Speaker 2: try harder, and they popped a little winky face on
Speaker 2: them as well, so, you know, needless to say, they
Speaker 2: are very, very confident. And then in another post they
Speaker 2: also threatened Australia specifically, with one member writing Australia, I
Speaker 2: really hope, for the love of God, you've learned your
Speaker 2: lesson this time.
Speaker 1: Well, they certainly have a certain tone to their statements,
Speaker 1: Yes before we go. For anyone listening to this who
Speaker 1: has received an email from Quantas saying that their data
Speaker 1: was part of this breach, For anyone who was affected,
Speaker 1: what do they what should they do now? Yeah?
Speaker 2: So, I mean the number one piece of advice is
Speaker 2: to just stay on high alert. Quantus has offered a
Speaker 2: specialist identity protection service in the meantime, so affective customers
Speaker 2: can call their twenty four to seven helpline on one
Speaker 2: eight hundred and nine seven five four one. But on
Speaker 2: top of that, you probably shouldn't be taking any calls
Speaker 2: for Quantas because it's very likely that that call could
Speaker 2: be coming from the hackers themselves. And because they have
Speaker 2: your details now, it's far easier for them to impersonate
Speaker 2: someone who works with Quantas or who knows you well,
Speaker 2: because they have those details and they can kind of
Speaker 2: put together a bit of a profile on you. While
Speaker 2: the hackers might not have access to financial details in
Speaker 2: this breach, they could be using that information to, you know,
Speaker 2: take out credit cards in your name or do other
Speaker 2: forms of identity thefts. So just keep a monitor on
Speaker 2: your accounts and make sure that anything that comes through
Speaker 2: that looks suspicious you're following that up.
Speaker 1: And lastly, anything from the Australian government on kind of
Speaker 1: what their involvement in this is.
Speaker 2: Yeah, so they've been pretty stern with Quantas over the
Speaker 2: whole incident. The cyber Security Minister Tony Burke has hinted
Speaker 2: at the possibility of a major fine for Quantus. He
Speaker 2: told the ABC yesterday quote, you can't simply outsource to
Speaker 2: other companies and think suddenly you've got no obligations on cybersecurity.
Speaker 2: Apart from that, it's another one of those situations where
Speaker 2: we'll just have to wait and see.
Speaker 1: One thing that I have found so interesting is yesterday's
Speaker 1: podcast on the person who allegedly started the fires in
Speaker 1: la earlier this year and then now this they've both
Speaker 1: had alleged criminals really using AI to further their crimes
Speaker 1: and the extent of their crimes, and it's just a
Speaker 1: real interesting space to also kind of keep your eye on,
Speaker 1: is how all of these alleged criminals are using AI
Speaker 1: to further perpetrate their crimes.
Speaker 2: Yeah. I think, unfortunately, we might be doing a couple
Speaker 2: more podcasts on this over the next few years.
Speaker 1: Yes, thank you so much Elliott for explaining that to
Speaker 1: us and thank you so much for listening to this
Speaker 1: episode of The Daily os. We'll be back this afternoon
Speaker 1: with your evening headlines, but until then, have a great day.
Speaker 2: My name is Lily Madden and I'm a proud Aarunda
Speaker 2: Bungelung Calcuttin woman from Gadigl Country.
Speaker 1: The Daily oz acknowledges that this podcast is recorded on
Speaker 1: the lands of the Gadigul Piece and pays respect to
Speaker 1: all Aboriginal and torrest Rate island and nations.
Speaker 2: We pay our respects to the first peoples of these countries,
Speaker 2: both past and present.