Latest / Tech Talks With Kinsoft / Court Services Victoria – A Hearing-Link List, 28,600 Lines, and the Victims Nobody Can Name

Transcript

Court Services Victoria – A Hearing-Link List, 28,600 Lines, and the Victims Nobody Can Name · Tech Talks With Kinsoft

0:00
You know, when you picture a high security digital
0:02
database, you usually picture the front door.
0:05
Like you imagine this massive impenetrable steel
0:08
vault. There are biometric scanners and penetration
0:13
tests running around the clock. Oh, yeah. Works.
0:16
Exactly. You've got compliance audits, an entire
0:20
team of cybersecurity professionals, and their
0:22
only job is making sure nobody's getting through
0:25
that front door. And you dedicate, I mean, virtually
0:28
all of your IT budget to fortifying that specific
0:31
entry point. You build the fortress. You document
0:34
it. You test it relentlessly. But then, and this
0:37
is the crazy part, you step back and you realize
0:40
the delivery guy propped open a window in the
0:42
janitor's closet with a brick just so he wouldn't
0:44
get locked out. Yeah, the classic back door.
0:46
Right. And that tiny forgotten window, that's
0:48
how the entire fortress falls. Oh. So welcome
0:51
to today's deep dive. We are thrilled you're
0:53
joining us because we are unpacking a highly
0:55
revealing cautionary tale from a recent tech
0:57
analysis by the team at Kinsa. It's a fascinating
1:00
read. It really is. We're looking at a data breach
1:04
that hit Court Services Victoria, or CSV, back
1:08
in July of 2026. And to really understand the
1:11
gravity of this, we have to look at what CSV
1:14
actually does, because it is not a court itself.
1:18
Right. It's more of the plumbing, almost. Exactly.
1:21
CSV is the statutory body that operates as the
1:24
administrative, the IT, and the registry backbone
1:27
for every single court in Victoria, Australia.
1:30
the Victorian Civil and Administrative Tribunal.
1:33
They are the engine room. Wow. OK. Yeah. They
1:35
manage the servers. They hold the data. They
1:37
run the networks. If a judge is viewing a sensitive
1:39
case file, they're viewing it on CSV infrastructure.
1:42
Here's where it gets really interesting, though,
1:44
which brings us to the core irony of this whole
1:46
event. Hackers did not go after the case files.
1:49
No. They didn't touch the crown jewel case management
1:52
system where all the heavily guarded legal records
1:54
live. They went straight through that propped
1:56
open window in the janitor's closet. They breached
1:59
the boring administrative scheduling layer right
2:02
next to the vault. Right. We're talking about
2:05
the video hearing invitation system. And the
2:07
reason you, the listener, need to pay attention
2:09
to this is that your workplace, regardless of
2:12
your industry, almost certainly has one of these
2:15
invisible systems running right now. Oh, without
2:17
a doubt. What's fascinating here is the lifecycle
2:20
of these peripheral systems, mostly because they
2:23
are born out of, well, sheer panic rather than
2:27
strategic design. Like during the pandemic. Exactly.
2:31
Think back to that massive shift to remote work.
2:34
Organizations needed a way to get people into
2:36
virtual rooms immediately. They spun up these
2:39
scheduling tools purely for convenience. Just
2:41
to keep the lights on. Right. They were never
2:43
meant for secure archival storage. They just
2:45
accumulate sensitive data purely as a byproduct
2:48
of making the important systems function. Yeah.
2:50
And then what? Six years later, nobody really
2:52
owns it. Exactly. Nobody audits it. But it's
2:55
still running because, you know, turning it off
2:57
might break a calendar integration somewhere.
2:59
Which is terrifying. Let's get into the specifics
3:02
of this breach because the geography and the
3:04
timeline reveal a lot about how these peripheral
3:06
systems actually operate in the wild. Yeah. Let's
3:10
look at the map. So this attack hit the Magistrates
3:13
Court of Victoria and the Children's Court of
3:16
Victoria. But it was heavily concentrated in
3:19
the regional circuit. Which is a key detail.
3:21
Yeah. Places across central and northern Victoria.
3:24
Like looking at the list here, we're talking
3:26
Bendigo, Castlemaine, Echuca. Krang, Kyneton,
3:33
Maryborough. It's a massive footprint. It is.
3:36
Mildura, Uyen, Robinvale, and Swan Hill. It's
3:40
like 10 different regional hubs. And there's
3:42
a very specific, I would say, mechanical reason
3:45
for that regional concentration. When you're
3:48
managing court cases across a sprawling geographic
3:50
footprint like that, the shift to virtual hearings
3:54
wasn't just a temporary pandemic measure. Right.
3:56
It became permanent. Yes. It became a permanent
3:58
logistical necessity. I mean, a magistrate or
4:01
a specialist lawyer can't lose an entire day
4:03
driving to Robinville for a 30 -minute procedural
4:05
hearing. Oh, that makes total sense. So the regional
4:08
court's dependency on that virtual infrastructure
4:10
was exponentially higher than in the metropolitan
4:12
centers, which creates this massive, heavily
4:15
concentrated data footprint in this random peripheral
4:17
scheduling app. Wow. OK, so I was looking at
4:20
the timeline of how this actually unfolded and
4:22
there's a gap that feels genuinely concerning.
4:24
The July timeline. Yeah. So the breach happens
4:26
in July 2026. On July 15th, a threat actor using
4:30
the handle of 2019 posts a sample of the data
4:33
on an underground forum like as proof. And then
4:37
they dump the entire data set on an anonymous
4:40
file host. Right. But CSV doesn't publish a public
4:44
notification or issue a statement to the media
4:46
until July 30th. Which seems like a long time.
4:49
15 days. 15 days is an eternity in incident response.
4:53
What were they doing for two weeks while this
4:55
data was just sitting on the dark web? By August
4:58
5th and 7th, the magistrate's court is republishing
5:01
the notice and the ABC is reporting that police
5:03
are investigating. It looks slow from the outside,
5:06
absolutely. But we have to factor in the forensic
5:08
reality of dealing with unstructured shadow IT.
5:12
Unstructured meaning like it's not neatly organized.
5:15
Exactly. Look. When your main SQL database is
5:17
breached, your monitoring tools usually scream
5:19
immediately. You can pull logs, see exactly which
5:22
tables were queried, and map the whole exfiltration
5:24
path in a matter of hours. Because it's monitored.
5:27
Right. But when a peripheral scheduling layer
5:29
is compromised, you are often dealing with fragmented
5:32
webhook logs, API calls, and ephemeral data streams.
5:36
Ah, so it's a mess. A total mess. The security
5:39
team at CSV likely spent those 15 days painstakingly
5:43
reverse engineering the attacker's footprints.
5:47
Just to figure out what this forgotten system
5:49
actually contained, let alone securing the vector
5:51
so the attacker couldn't get back in. OK, that
5:54
actually makes the media's reaction to this even
5:56
more interesting because the narrative drifted
5:59
incredibly fast once that public notification
6:01
finally did go out on July 30th. It really did.
6:04
Let's look at what was actually taken. And I
6:07
will say CSV was. refreshingly transparent here.
6:10
They listed the breached fields right out of
6:13
the gate. Which is commendable. Yeah. Now, Australian
6:15
courts are open by default. So things like case
6:18
titles, case numbers, hearing dates and times,
6:20
courtrooms and participant names, those are technically
6:23
public record. Right. The critical elements were
6:25
the two non -public fields that got compromised.
6:27
The email addresses. Email addresses and the
6:30
description of the person's role in the matter.
6:33
Were they the defense lawyer? Yeah. An observer?
6:36
Court staff? But the vault held. I think that's
6:39
important to state. There was no employee H .R.
6:42
data taken, no financial records and most importantly,
6:45
no substantive court records or transcripts from
6:48
the case management system were touched. The
6:50
core system was safe. Exactly. Yet if you read
6:54
the mainstream coverage at the time, you would
6:55
think this was a catastrophic census leak. The
6:58
hacker, 2019, claimed they had 28 ,600 lines
7:03
of data. Lines, yes. Right. The media rounded
7:06
that up to 30 ,000. And within a day, the headline
7:09
drifted into implying that 30 ,000 people were
7:11
affected. But CSV completely refused to publish
7:14
a specific headcount. And I would argue that
7:16
refusing to publish a number was actually the
7:18
most scientifically honest thing CSV could have
7:21
done in that moment. moment. Hey, I have to push
7:22
back on that. You're telling me a government
7:24
statutory body, the IT backbone for entire states
7:27
judiciary, cannot simply query their own database
7:30
to count how many distinct individuals were exposed.
7:33
I'm telling you exactly that. Yes. Don't you
7:35
just run a deduplication script or something
7:37
and get your number? See, you're assuming this
7:39
was a structured relational database built with
7:41
unique primary keys for every individual. Like
7:44
a proper user directory. Exactly. But it wasn't.
7:48
It was an ephemeral scheduling tool. It generates
7:50
text strings to populate calendar invites. Trying
7:54
to run data deduplication on that kind of unstructured
7:57
export is, well, it's like trying to unbake a
8:00
cake. Give me a real -world scenario of what
8:03
that looks like in the data. Like, why is it
8:05
so messy? Okay, imagine a local legal aid lawyer
8:07
representing four different clients in four different
8:10
hearings over a two -week period. Okay, pretty
8:12
common. That lawyer generates four separate disjointed
8:16
rows in this export. If a hearing is canceled
8:19
and rescheduled, that spawns more rows. Oh, I
8:22
see. If a clerk misspells a participant's email
8:25
in one invite but gets it right in another, the
8:28
system sees two entirely different entities.
8:30
Right, because there's no central profile checking
8:32
it. Exactly. And sometimes multiple family members
8:35
share a single email address for court correspondence.
8:39
This system was designed to fire off Microsoft
8:41
Teams links, not to act. as an authoritative
8:45
census of individuals. That makes a lot of sense.
8:47
Converting 28 ,600 messy, malformed text strings
8:51
into an accurate human headcount is technically
8:54
impossible without making massive assumptions.
8:57
So the 28 ,600 number is essentially just a hacker
9:00
bragging about the size of a text file, not a
9:02
confirmed victim count. Precisely. But we can't
9:05
let the technical format of the data distract
9:07
from the real world implications of what those
9:09
text strings actually represent. I mean, this
9:11
isn't a leaked corporate newsletter list. No,
9:13
it's definitely not. The ABC reported that the
9:16
magistrate's court hears family violence applications.
9:19
The children's court handles highly sensitive
9:21
custodial matters. And this is where we have
9:23
to fundamentally reevaluate how we think about
9:26
metadata. We have this dangerous habit in the
9:29
tech industry of treating metadata as a lesser
9:32
harmless class of data. Just administrative exhaust,
9:35
right? Exactly. A name, a time, an email address.
9:39
Individually, those are just data points. Yeah.
9:41
You probably have your name and email sitting
9:43
on a dozen public websites right now. Sure, yeah.
9:45
I don't consider my work email address a state
9:48
secret. But if we connect this to the bigger
9:50
picture, metadata ceases to be harmless the moment
9:54
you inject context. Context. Yes. If I take your
9:57
name and email and I lock it to the context that
10:00
you were attending a... regional family violence
10:03
intervention order hearing on a specific date
10:06
in a specific role. Wow. Yeah. That is no longer
10:10
metadata. That is a highly sensitive, genuinely
10:12
dangerous document. An intervention order exists
10:15
strictly to keep a violent or dangerous person
10:18
away from a vulnerable person. The context itself
10:21
is the payload. Context is data. That is a brilliant
10:24
way to frame it. And it's clear CSV understood
10:26
exactly how explosive this context was. Their
10:29
response showed that, yes. Yeah, when you look
10:30
at their incident response, they didn't just
10:32
throw up a generic IT support page with links
10:34
on how to monitor your credit score. No, they
10:37
didn't. They explicitly linked to domestic violence
10:40
crisis services. The orange door, safe steps,
10:44
the victims of crime helpline. Which is a heavy
10:47
thing for an IT department to have to do. Totally.
10:49
An organization does not put domestic violence
10:51
hotlines on a cyber breach page unless they know
10:54
exactly who might be reading it and that their
10:56
physical safety is actively in jeopardy. It demonstrates
10:59
a very mature understanding of their threat model.
11:02
They recognize that the risk wasn't financial
11:05
fraud. It was physical stalking and retaliation.
11:09
But knowing that severe human risk, we have to
11:12
critically evaluate how CSV actually responded
11:15
to the crisis. It's a mixed bag, structurally
11:17
speaking. Right. So technical containment is
11:20
one thing. They shut down the access vector.
11:22
They confirmed the main case management system
11:24
was untouched, which helps stop the media speculation.
11:27
This is good. But they made a very controversial
11:29
decision regarding the victims themselves. They
11:31
chose not to directly notify the individuals
11:33
whose data was leaked. Yeah, that caused an uproar.
11:36
They just set up a public FAQ and a dedicated
11:39
phone line. It was Air 3, 9087 -6111. But there
11:44
were no direct emails sent out to the affected
11:46
parties. And that decision drew a lot of criticism.
11:49
But the analysis from Kinsoft defends it as an
11:53
impossible choice. OK, so what does this all
11:56
mean? Are they just taking the easy way out by
11:58
not emailing the victims? Because if my involvement
12:01
in a family violence hearing was just dumped
12:03
on the dark web, I would want to know immediately.
12:05
Of course you would. Relying on victims to proactively
12:08
check a public FAQ and dial a hotline. It feels
12:12
like the organization is washing its hands of
12:14
the hardest part of incident response. It feels
12:16
like an abdication of responsibility. Absolutely.
12:19
But let's connect this back to what we just discussed
12:21
about the unstructured, messy reality of the
12:23
data. Cheat text strings. Yes. CSV couldn't accurately
12:27
deduplicate the rows. If they attempted a mass
12:29
email notification based on unverified, fragmented
12:33
text strings, the collateral damage would be
12:35
immense. How so? I mean, if you email the wrong
12:37
person, they just ignore it, right? It goes to
12:39
spam. Not in this context. Imagine a scenario.
12:42
Where an abusive ex -partner has access to a
12:45
shared family email address or compromised the
12:48
victim's email account years ago. Oh, wow. If
12:51
CSV sends an automated breach notification to
12:54
that address saying your attendance at a family
12:57
violence hearing was exposed, the notification
12:59
itself acts as a trigger for violence. Oh, my
13:02
God. I didn't even think of that. Or what if
13:04
the scheduling tool had the wrong email entirely?
13:07
and a complete stranger is suddenly informed
13:10
about a neighbor's highly sensitive family court
13:12
matter. When your data quality is that poor,
13:15
the act of notification becomes a severe security
13:18
risk in itself. That completely flips the paradigm.
13:21
The inability to safely notify people isn't a
13:24
failure of the crisis response team. It's a failure
13:26
of the system's architecture from day one. Precisely.
13:29
Because they built a quick scheduling tool instead
13:31
of a secure identity platform, they permanently
13:33
stripped themselves of the ability to safely
13:36
warn victims years later. Yes. Your crisis options
13:39
are dictated entirely by the design decisions
13:41
you made during procurement. Which naturally
13:43
leads to the broader organizational takeaways
13:45
here. The Kinsoft source breaks down four key
13:48
lessons for anyone listening, starting with find
13:51
the scheduling layers. We have to start actively
13:53
hunting for these hidden layers in our own networks.
13:56
You have to ask yourself, what did your workplace
13:58
spin up in 2020 that is still running? Right.
14:00
A visitor management iPad in the lobby. A telehealth
14:04
joining link. A room booking app. You have to
14:06
look at those systems and ask, if this entire
14:09
database was published on the Internet tomorrow,
14:11
what would it reveal? Which leads to lesson two.
14:15
Context? is data. Exactly. As we established,
14:19
merely recording that an event happened is a
14:21
massive disclosure. If your company uses software
14:23
to track who books the internal HR grievance
14:26
room, that schedule is highly confidential data,
14:29
regardless of whether the actual meeting notes
14:31
are secure. And that ties perfectly into lesson
14:33
three, which is frankly the most frustrating
14:35
aspect of this entire breach. Retention is security.
14:38
The data CSV lost spanned from 2022 to 2026.
14:42
Four years of data. Four years. They were holding
14:45
on a temporary video link scaffolding for four
14:48
years. That drives me crazy. What possible operational
14:52
purpose is served by keeping a meeting link for
14:54
a procedural hearing that concluded in 2022?
14:57
None. There is none. The case is closed. The
15:00
legal transcripts are locked away in the secure
15:03
vault. This scheduling data is essentially...
15:06
digital exhaust and they were just hoarding it.
15:09
We treat data storage like a digital junk drawer
15:11
because cloud storage is practically free. But
15:15
hoarding ephemeral data is just hoarding risk.
15:18
Retention policies are the cheapest, most effective
15:21
security control any organization possesses.
15:23
You just said it to delete automatically, right?
15:25
You simply configure the system to automatically
15:27
delete administrative logs after 60 or 90 days.
15:30
If CSV had implemented an automatic 12 -month
15:32
deletion rule on that peripheral app, they would
15:35
have reduced the blast radius of this hack by
15:38
75%. For zero cost. Well, nobody ever bothers
15:40
to turn those controls on for the boring administrative
15:42
apps. And that oversight gets heavily compounded
15:45
by Lesson 4. Regulatory blind spots. Oh, this
15:48
is a big one. It is. When most IT professionals
15:51
hear data breach in Australia, their minds immediately
15:54
jump to federal legislation. They start pulling
15:56
up playbooks for the Privacy Act and the Office
15:59
of the Australian Information Commissioner, the
16:01
OAIC. But CSV is not a federal body. They are
16:04
a state agency. Exactly. They fall under the
16:07
Victorian Privacy and Data Protection Act of
16:09
2014, which means they are regulated by the Office
16:12
of the Victorian Information Commissioner, OVIC.
16:16
Let's pause on that because the distinction between
16:18
OVC and OAIC sounds like, you know, bureaucratic
16:21
alphabet soup. It does. But the implications
16:24
for an incident response team are massive. Thousands
16:27
of private IT firms provide services to state
16:30
government clients. If their internal crisis
16:33
runbook is only built for federal law, they are
16:35
essentially playing chess with checkers rules.
16:38
That is a perfect analogy. Victoria, New South
16:41
Wales, Queensland and the Commonwealth all operate
16:43
under entirely different notifications. schemes,
16:46
different thresholds for harm, and different
16:48
regulatory bodies. So you can't just have one
16:50
playbook. No. If your managed service provider's
16:54
runbook mandates notifying the OAIC within 30
16:57
days, but your client is a Victorian state agency
17:01
with a fundamentally different statutory obligation,
17:04
your incident response plan is legally noncompliant
17:07
before you even execute step one. Wow. IT vendors
17:11
have to map these regulatory boundaries today,
17:13
not while the network is actively bleeding data.
17:16
It really is a masterclass in modern risk management.
17:19
You have to map your hidden layers, recognize
17:21
that context transforms metadata into a weapon,
17:24
weaponize data retention as a fence mechanism,
17:27
and clearly define your regulatory jurisdiction.
17:29
That covers all the bases. But as we wrapped
17:31
up this deep dive, there is one final detail
17:33
from the source material that ties this entire
17:35
narrative together. Down in the FAQ that CSV
17:38
published, they explicitly confirmed that this
17:40
This compromised scheduling system is completely
17:42
unrelated to a previous highly publicized breach
17:45
they suffered back in 2024. It is a very truthful
17:48
clarification, but it also accidentally summarizes
17:51
the core failure of modern cybersecurity. Well,
17:53
after CSV had their severe incident in 2024,
17:57
they did what any rational organization would
17:59
do. They poured resources into heavily fortifying
18:03
the specific system that got breached. They bought
18:05
a thicker, heavier vault door. They added more
18:08
lasers and more guards to the front entrance.
18:11
Yes. But threat actors do not care about your
18:14
new vault door. They aren't fixated on a system
18:16
just because you recently hardened it. They are
18:18
attacking the entire organizational surface area.
18:21
So they just walk around the building looking
18:22
for a window. Exactly. The next breach never
18:25
comes through the door you just reinforced. It
18:27
comes through the one you completely forgot was
18:29
even a door. When an organization finishes a
18:32
post -incident review, the question shouldn't
18:34
just be, did we fix the thing that broke? The
18:38
essential question is, what else in our tech
18:40
stack operates exactly like the broken thing
18:42
did before we realized it was vulnerable? That
18:46
is a fundamental shift in how we need to view
18:48
network architecture. It's not about defending
18:50
the castle. It's about knowing where all the
18:52
tunnels are. And if we step back and look at
18:55
the broader trajectory of our digital infrastructure,
18:57
this incident forces us to confront a very uncomfortable
19:01
reality about shadow IT and convenience. Okay,
19:05
I'm listening. Think about it. If every major
19:08
organization, governments, hospitals, corporations,
19:11
is legally fortifying their centralized legacy
19:14
databases. The vaults. The vaults. But simultaneously,
19:17
they are offloading the messy logistical work
19:20
to dozens of third -party integrations, temporary
19:23
microservices, and unvetted scheduling apps just
19:26
to make daily operations frictionless. Well.
19:30
We aren't actually securing our data. We're just
19:32
moving the risk around. Worse. We are simply
19:34
building a society where our most sensitive human
19:36
moments are perpetually scattered across a forgotten,
19:39
invisible periphery. We have to ask ourselves,
19:42
when our fragmented digital identities are permanently
19:45
accumulating in these neglected administrative
19:46
layers, is the illusion of a secure vault just
19:50
a comforting lie we tell ourselves to keep the
19:52
calendar invites flowing? Are we trading our
19:54
SASE just for the sake of seamless digital convenience?
19:57
That is a haunting thought to leave on. The front
19:59
door might be locked tight, but we are the ones
20:01
propping the windows open just to make the day
20:03
run a little smoother. Thank you so much for
20:07
joining us on this deep dive. Take a hard look
20:09
at the invisible doors in your own digital lives,
20:11
and we'll catch you next time.