Latest / The Front / Is your super safe from hackers?

Transcript

Is your super safe from hackers? · The Front

• 0:05
  Speaker 1: From The Australian. Here's what's on the front. I'm Claire Harvey.
• 0:08
  Speaker 1: It's Wednesday, April nineth, twenty twenty five, and for now
• 0:14
  Speaker 1: Benezi and Peter Dutton have faced off in the first
• 0:16
  Speaker 1: debate of this election campaign, a clash that inevitably turned fiery.
• 0:22
  Speaker 2: In the twenty fourteen budget, thirty b and dollars was
• 0:25
  Speaker 2: repped out of public schools. In that budget, fifty b
• 0:29
  Speaker 2: and dollars was repped out of hospitals. That is not
• 0:32
  Speaker 2: the factually correct statement. It's misleading, it's designed to scare people,
• 0:37
  Speaker 2: and I think it's dishonest from a man who wants
• 0:39
  Speaker 2: to be re elected as the Prime minister of our country.
• 0:42
  Speaker 2: In forty years, there has not been a higher spending
• 0:45
  Speaker 2: government than your government. Is that correct?
• 0:47
  Speaker 3: Well, that's not true, except for the one that you
• 0:49
  Speaker 3: were a part of.
• 0:52
  Speaker 1: The Greens are pitching their campaign at Australia's seven million renters,
• 0:56
  Speaker 1: with leader Adam Bandt at the Press Club on Wednesday
• 0:59
  Speaker 1: to demand capital gains, tax breaks and negative gearing be
• 1:03
  Speaker 1: axed and a freeze on rent increases. All the latest
• 1:08
  Speaker 1: from the campaign and our experts analysis is live now
• 1:12
  Speaker 1: at the Australian dot com dot au. Australian super has
• 1:18
  Speaker 1: finally called in the police to investigate a hack that
• 1:21
  Speaker 1: saw four hundred and six thousand dollars drained from an
• 1:25
  Speaker 1: elderly customer's superannuation account. But the scandal has revealed huge
• 1:30
  Speaker 1: holes in superfund's ability to keep our money away from criminals,
• 1:34
  Speaker 1: or even to allow us to log into their websites
• 1:37
  Speaker 1: to find out how much money we have left today?
• 1:41
  Speaker 1: Is our money safe in super? Towards the end of March,
• 1:50
  Speaker 1: a seventy four year old Queensland woman received some correspondence
• 1:54
  Speaker 1: from her superannuation fund. We'll call her Joan. Australian super
• 1:59
  Speaker 1: was writing to Joan, it said, to confirm withdrawals made
• 2:03
  Speaker 1: from her account a week earlier. That's odd, Joan hadn't
• 2:08
  Speaker 1: made any withdrawals, much less for one hundred thousand dollars
• 2:11
  Speaker 1: at a time, and it wasn't just one. Joan realized
• 2:15
  Speaker 1: with increasing horror that six withdrawals totaling four hundred and
• 2:19
  Speaker 1: six thousand dollars had been made from her super over
• 2:23
  Speaker 1: the space of a week. When she alerted the superfund
• 2:26
  Speaker 1: to the fraud, she expected a swift response, but for
• 2:30
  Speaker 1: ten agonizing days. It was crickets. The fund failed to
• 2:35
  Speaker 1: raise the incident with the Commonwealth Bank and didn't commit
• 2:38
  Speaker 1: to covering the loss until The Australian's Business reporter Cleoner
• 2:42
  Speaker 1: O'Dowd started asking questions almost three weeks after the attack began.
• 2:48
  Speaker 1: And Joan's not the only one caught up in this mess.
• 2:53
  Speaker 4: Several Australian superannuation funds have been targeted by cyber criminals.
• 2:59
  Speaker 4: It's caused panic and frustration for thousands of members who've
• 3:03
  Speaker 4: been unable to check whether their nest egg has been impacted.
• 3:11
  Speaker 1: Jared Lynch is The Australian's Technology editor. The story of
• 3:15
  Speaker 1: Joan and her loss of four hundred and six thousand
• 3:18
  Speaker 1: dollars from her superfund is just staggering. And what does
• 3:22
  Speaker 1: that tell us about the safety of all of our funds.
• 3:25
  Speaker 3: It tells us that our safety is expendable and can
• 3:29
  Speaker 3: be cracked within seconds by anyone who's got the will
• 3:33
  Speaker 3: to be able to do that. How they've been able
• 3:36
  Speaker 3: to get in the hackers is that they've got a
• 3:38
  Speaker 3: heap of people's usernames. They've ever tried to get a
• 3:42
  Speaker 3: heap of passwords from the dark web, from previous breaches
• 3:45
  Speaker 3: or they have done what's called a brute force attack,
• 3:47
  Speaker 3: which is to keep guessing, scrambling, guessing until you're getting
• 3:50
  Speaker 3: through the door. And because there's no multi factor of
• 3:53
  Speaker 3: authentication which means you get a notification on your phone
• 3:57
  Speaker 3: or through a third party app to verify yourself, that
• 4:00
  Speaker 3: means that they can walk straight in through the door
• 4:03
  Speaker 3: and do what they like with your account.
• 4:06
  Speaker 1: How big is this jared compared to other hacks that
• 4:09
  Speaker 1: we've seen of major companies like, for example, OPTAs.
• 4:12
  Speaker 3: Australia super would love to compare it to OPTAs, saying
• 4:15
  Speaker 3: that well, they had the data of nine and a
• 4:17
  Speaker 3: half million Australian stolen. We've only had a very small
• 4:21
  Speaker 3: problem here and that of course has been the problem
• 4:23
  Speaker 3: with the super funds, which is why they've been so
• 4:26
  Speaker 3: laxed when it comes to cybersecurity. And I'm not saying this.
• 4:29
  Speaker 3: The Australian Securities and Investments Commission is saying this. They
• 4:32
  Speaker 3: set it back in January saying that your weak online
• 4:35
  Speaker 3: security is exposing your members to scams. Do something about it.
• 4:39
  Speaker 3: And rather than doing something about it, the Association of
• 4:42
  Speaker 3: Super Funds Off Australia CEO said, you're raising unnecessary alarm.
• 4:48
  Speaker 3: Super funds are the safest places in Australia to put
• 4:52
  Speaker 3: your money. So nothing happened and as a result we've
• 4:56
  Speaker 3: now seen this huge cyber attack because they thought, well
• 4:59
  Speaker 3: it's only a little problem. Well little problems can turn
• 5:03
  Speaker 3: into big problems. To paraphrase Paul Kelly, from little things,
• 5:06
  Speaker 3: big things grow and that is indeed what is happening.
• 5:11
  Speaker 1: Four super funds were targeted by cyber criminals in the
• 5:14
  Speaker 1: coordinated attack, Australian Super, Australian Retirement Trust HOST Plus and
• 5:20
  Speaker 1: REST the retail employee's superannuation trust. They manage almost a
• 5:25
  Speaker 1: trillion dollars in retirement savings on behalf of thousands of
• 5:29
  Speaker 1: Australians like Joan, who's one of four Australian supercustomers confirmed
• 5:34
  Speaker 1: to have lost money in the hack. Australian Super is
• 5:37
  Speaker 1: still combing through the six hundred accounts that were breached,
• 5:41
  Speaker 1: while other funds scramble to reassure their anxious customers.
• 5:47
  Speaker 5: No suspicious transactions or changes have been detected on member accounts.
• 5:53
  Speaker 2: We recognize how frustrating this can be and sincerely appreciate
• 5:57
  Speaker 2: your patience. An unusually high spe can log in attempts.
• 6:02
  Speaker 1: We are experiencing a high volume of calls to our
• 6:04
  Speaker 1: contact center, resulting in a longer than normal wait time.
• 6:09
  Speaker 1: So Jared, now we get to the mystery of why
• 6:12
  Speaker 1: police weren't involved right from the beginning. What are you
• 6:16
  Speaker 1: hearing now from Australian super about if or when the
• 6:19
  Speaker 1: police were called.
• 6:22
  Speaker 3: Well, the good news is that they have contact a
• 6:24
  Speaker 3: Metaday to say that we have reported it to the AFP.
• 6:27
  Speaker 3: Five days after the hackers struck they decided to call
• 6:30
  Speaker 3: in the coppers and that was only because probably that
• 6:33
  Speaker 3: we did a front page story saying they hadn't called
• 6:35
  Speaker 3: the AFP, who, of course, are the federal agency tasks
• 6:39
  Speaker 3: with investigating such crimes, because as we all know, they're
• 6:42
  Speaker 3: the ones that we're able to track down the Russian
• 6:44
  Speaker 3: hacker that was responsible for the medibank attack back in
• 6:47
  Speaker 3: late twenty two.
• 6:49
  Speaker 5: The AFP is undertaking covert measures and working around the
• 6:54
  Speaker 5: clock with our domestic agencies and our international networks, including
• 6:59
  Speaker 5: into POL. This is important because we believe those responsible
• 7:04
  Speaker 5: for the breach are in Russia.
• 7:08
  Speaker 3: Super funds, a lot of them, not all of them,
• 7:10
  Speaker 3: but a lot of them are regulated by the Australian
• 7:13
  Speaker 3: Prudential Regulatory Authority, and when these sort of hacks happen,
• 7:18
  Speaker 3: APROA do a review and if they have found that
• 7:21
  Speaker 3: your cyber defenses are inadequate or weak, then they can
• 7:26
  Speaker 3: impose pretty harsh penalties, which is what they did with
• 7:28
  Speaker 3: Medibank after their attack, and the same thing can happen here.
• 7:32
  Speaker 3: The problem is we don't know what that is until
• 7:35
  Speaker 3: probably potentially weeks or even months after the event, until
• 7:40
  Speaker 3: the forensic analysis has been done. APRA comes in and
• 7:43
  Speaker 3: does their investigation, and all that is very poor comfort
• 7:46
  Speaker 3: to members who the reason why they're with an industry
• 7:49
  Speaker 3: super fun to begin with is they're there to profit members,
• 7:51
  Speaker 3: not themselves, and any fines are taken from the member's
• 7:56
  Speaker 3: pot of money. So they're up in arms say, well,
• 7:58
  Speaker 3: what point is it to find the super funds. That's
• 8:01
  Speaker 3: my money that you're taking away, and I've already been
• 8:04
  Speaker 3: hit with this cyber attack, so it's almost like punishing
• 8:06
  Speaker 3: the victims of crime.
• 8:08
  Speaker 1: The other big threat to Australian superbalances right now is
• 8:11
  Speaker 1: Donald Trump and his Liberation Day tariffs, which are draining
• 8:15
  Speaker 1: money out of all our superbalances day to day. That's
• 8:18
  Speaker 1: why hundreds of thousands of Australians are wanting to log
• 8:22
  Speaker 1: on and look at their superbalances to see what's going on,
• 8:25
  Speaker 1: to see how much money they've got left. Should the
• 8:28
  Speaker 1: funds have to be able to deal with that kind
• 8:32
  Speaker 1: of volume, Jared, Surely it's not out of the realm
• 8:34
  Speaker 1: of consideration that everybody would want to log on all
• 8:38
  Speaker 1: on the one day to see if their money is
• 8:39
  Speaker 1: still there.
• 8:40
  Speaker 3: You're absolutely spot on there if they're providing a service
• 8:43
  Speaker 3: and they've got to make sure people access it. And
• 8:45
  Speaker 3: when you look at a massive geopolitical event which is
• 8:48
  Speaker 3: causing considerable anxiety, particularly as you approach preservation age where
• 8:53
  Speaker 3: you're about to draw down on that super naturally you
• 8:55
  Speaker 3: are going to want to check out what your balances
• 8:58
  Speaker 3: are etc. Also, the closer you are to preservation age,
• 9:03
  Speaker 3: the more vulnerable you are to scams because you're wanting
• 9:06
  Speaker 3: to go in logging, work out how you're going to
• 9:09
  Speaker 3: manage your money, etc. And that was one of the
• 9:12
  Speaker 3: things Acid called out that super trustees had no way
• 9:17
  Speaker 3: of knowing whether someone who was approaching preservation age was
• 9:22
  Speaker 3: being tricked and a victim of a scam. And that
• 9:25
  Speaker 3: was one thing that Acid called out back in January
• 9:28
  Speaker 3: and which their lobby group said they're be an alarmist.
• 9:33
  Speaker 3: There's nothing to see here. More or less.
• 9:38
  Speaker 1: Coming up, the super fun say they're the safest place
• 9:41
  Speaker 1: in the world to keep your money. Does that stack up, Jared?
• 10:02
  Speaker 1: Because they have so much of Australian's money under management.
• 10:06
  Speaker 1: Super funds are incredibly powerful as forces in our society
• 10:10
  Speaker 1: in terms of what they do or don't invest in,
• 10:14
  Speaker 1: what values they expect companies to uphold, if they're going
• 10:17
  Speaker 1: to give them our money. What are we seeing do
• 10:21
  Speaker 1: you think in the balance of the way super funds
• 10:24
  Speaker 1: themselves operate and expect others to operate.
• 10:27
  Speaker 3: So it's very much do as I say, not as
• 10:31
  Speaker 3: do as I do. And one of the reasons why
• 10:34
  Speaker 3: we haven't seen this big diversity, equity and inclusion pushback
• 10:39
  Speaker 3: that we've seen happen in the US is because of
• 10:42
  Speaker 3: Australia's super funds. Because they sit on about four trillion
• 10:45
  Speaker 3: dollars worth of savings and use their enormous clout to
• 10:49
  Speaker 3: push their own agenda onto Australia's top companies. That's just
• 10:53
  Speaker 3: a reality. They're sitting on the biggest pot of retirement
• 10:55
  Speaker 3: savings in the country and they're not afraid to flex
• 10:58
  Speaker 3: that financial muscle, but when it comes to their own house,
• 11:02
  Speaker 3: it's an absolute mess. They're saying it is one of
• 11:05
  Speaker 3: the safest places in the country where you can park
• 11:07
  Speaker 3: your money, and that is true, but what we've seen
• 11:10
  Speaker 3: is their corporate governance is wanting. They are a soft target.
• 11:14
  Speaker 3: They're sitting on trillions of dollars worth of retirement savings.
• 11:17
  Speaker 3: That is a huge honeypot for hackers. And if they
• 11:20
  Speaker 3: don't clean up their shop, make sure that they adopt
• 11:24
  Speaker 3: the same level of governance that they demand from the
• 11:26
  Speaker 3: likes of Wistech and other Australian companies, then our retirement
• 11:31
  Speaker 3: savings are at risk to these sort of data breaches, attacks,
• 11:36
  Speaker 3: you name it. They got to clean up their act.
• 11:40
  Speaker 1: Jared Lynch is The Australian's Technology editor. You can read
• 11:46
  Speaker 1: all our reporting on this hack and on the superannuation
• 11:49
  Speaker 1: sector right now at the Australian dot com dot au