World

Inadequate privacy safeguards and the stockpiling of sensitive customer information have made Australia a lucrative target in the eyes of foreign hackers, cybersecurity experts told AFP following a series of major data breaches.

Medibank, Australia’s largest private health insurer, recently confirmed that hackers had accessed the data of 9.7 million current and former customers, including medical records related to drug abuse and pregnancy terminations. 

Telecom company Optus fell prey to a data breach of similar scale in late September, during which the personal details of up to 9.8 million people were accessed. 

Both incidents sit comfortably among the largest data breaches in Australian history. 

Australian National University cybersecurity expert Thomas Haines said many companies had been hoarding personal data that they should not have been hanging on to. 

“There was a famous line for a while: Data is the new oil,” he told AFP. 

“If data is the new oil, then we’re living the era of the weekly oil spill.” 

Haines contrasted Australia’s approach with that of the European Union, which in 2018 adopted sweeping privacy reforms limiting how organisations collect, use and store personal data.

“There have got to be incentives in place to stop companies hoarding data they don’t need, or to penalise those companies for big leaks. Europe has done this,” he said.

“At the moment the business incentives are basically along the lines of: Let’s just keep a whole bunch of data.”

Haines said Medibank appeared to be an exception, in that most of the sensitive information within its databases had been stored for good reason. 

– Hacking ‘for profit’ – 

Australia’s comparatively weak safeguards against identity theft meant it was also easier to exploit stolen personal information, Haines said. 

“All they need to know is your passport, your driver’s licence and some other things — and then I can start taking out loans in your name.”

Haines said European countries such as Norway had much more stringent requirements involving face-to-face contact.

Dennis Desmond, a former FBI agent and US Defense Intelligence Agency officer, said most hackers were searching for particular types of data. 

“For-profit hackers are going after healthcare data, they’re going after identity data and credentials to access systems,” he told AFP.

“There is a profit motivation there, otherwise they wouldn’t be risking jail and prosecution.”

The Medibank hackers this week started leaking stolen data to a dark web forum, after the company refused to pay a US$9.7 million (Aus$15 million) ransom.

The Optus breach led to the theft of customers’ names, birth dates, and passport numbers.

– Russia blamed –

Australian Federal Police Commissioner Reece Kershaw on Friday blamed the Medibank cyberattack on a team of hackers based in Russia.

“We believe those responsible for the breach are in Russia,” he told reporters.

“Our intelligence points to a  group of loosely affiliated cyber criminals who are likely responsible for past significant breaches in countries across the world.”

Medibank data leaked to the dark web so far has included hundreds of potentially-compromising medical records related to drug addiction, alcohol abuse and sexually-transmitted infections. 

Home Affairs Minister Clare O’Neil conceded on Friday the country’s cyber defences had not always been up to scratch. 

University of Sydney data researcher Jane Andrew said one major flaw was that Australian companies were not always obliged to report data breaches. 

“There are heaps of data breaches happening all the time that we don’t hear anything about,” she told AFP. 

“Companies have been gathering data because it’s seen to be valuable, without fully understanding the potential risks.” 

China announced the relaxation of some of its hardline Covid-19 restrictions on Friday, after authorities had vowed to stick to a zero-tolerance virus approach despite mounting economic damage.

The country is the last major economy welded to a strategy of stamping out virus flare-ups as they occur, through a combination of snap lockdowns, mass testing and lengthy quarantines.

Top leaders had pledged to stick “unswervingly” to the policy, which has forced business closures, roiled international supply chains and weighed heavily on growth.

But a notice from the country’s disease control agency on Friday said the Politburo Standing Committee — the apex of power in China — met Thursday to rubberstamp limited relaxations.

According to the notice, quarantines for inbound travellers will be cut from 10 days to eight, consisting of five days in a state isolation centre and three days at home.

Inbound arrivals will still be required to undergo six nucleic acid tests and will not be allowed to freely set foot outside during those eight days, the notice says.

It adds that travellers will only be required to show one negative Covid test within 48 hours of boarding flights to China, a reduction from the current two tests.

– Relaxing strict policies –

The new rules single out “important business personnel” and “sports groups” as examples of privileged groups permitted to skip quarantine as long as they remain in a virus-secure “closed loop” for the duration of their stays.

It added that a so-called “circuit breaker” mechanism on inbound flights would be abolished, bringing an end to a policy that saw the snap closures of flight routes if a certain proportion of passengers tested positive for the virus.

In further signs of easing, the notice did away with the requirement to identify and isolate “secondary close contacts” — those who may have come into contact with people who recently passed near infected people.

A domestic virus risk system has been reduced from three tiers to two, with areas to be labelled as either “high-risk” and subject to curbs, or “low-risk” with minimal restrictions.

People travelling from high- to low-risk areas will be required to undergo seven days of isolation at home, instead of staying in centralised facilities.

Places will be defined as “low-risk” if they record zero new infections for five successive days.

Workers in environments where exposure to the virus is higher — such as cabin crews, airport staff and quarantine hotel personnel — will undergo shortened quarantines, the notice said.

On Thursday, Chinese state media reported top leaders as saying they would not waver from the zero-Covid policy, echoing a vow last week to “unswervingly” stick to the strategy.

China’s Singles Day shopping bonanza entered its final stretch Friday, with all eyes on whether sales can top a record one trillion yuan ($140 billion) despite the country’s struggling economy.

Conceived by technology giant Alibaba, the informal holiday’s title riffs on a tongue-in-cheek celebration of singlehood inspired by the four ones — “11/11” — that denote its date of November 11.

It has grown to encompass much of China’s retail sector — including traditional brick-and-mortar stores, second-hand sales platforms and even rival shopping giant JD.com — with merchants offering varying levels of discounts starting in late October.

The combined gross value of products sold by Alibaba and JD.com this year “may surpass a trillion yuan,” Xiaofeng Wang, principal analyst at research firm Forrester, said in a note — up from the total of 965 billion yuan raked in at last year’s event.

Once a festival of frenzied consumption led by Alibaba’s effervescent founder Jack Ma, Singles Day has been more muted in recent years as Beijing cracks down on online platforms.

Last year’s holiday was virtually ignored by state-controlled news outlets with a host of other events competing for shoppers’ wallets.

Beijing resident Liu Yingxue said the Single’s Day atmosphere was “not as enthusiastic” as in previous years.

“Platforms like (Alibaba’s) Taobao and JD.com used to have more ads and promotions,” she told AFP. 

“And they don’t give so many discounts these days.”

– Economic strain –

The mood has been dampened further this year as Beijing persists with a zero-Covid strategy that has hammered business confidence and chipped away at consumer demand.

The holiday, conceived in 2009, has previously lured throngs of Chinese influencers alongside Western celebrities including Kim Kardashian and Taylor Swift, drawing heavy coverage in both domestic and international media.

This time around, a series of scandals and a campaign against tax evasion have lowered expectations of celebrity endorsements, with influential Chinese live-streamer Viya disappearing from social media late last year in the wake of a tax probe.

Alibaba said last week the event could “make a big difference” for retailers struggling with supply-chain disruptions and inflation this year, including a slew of foreign brands.

Businesses and consumers alike have been laid low by China’s stringent Covid prevention policies, which see officials wield snap lockdowns, mass testing and lengthy quarantines in response to a handful of cases.

Beijing resident Li Xiaofeng said the “state of the whole economy” was likely putting platforms and merchants under more pressure, “so they are offering fewer discounts”.

“I think it’s because of Covid,” said Lin Xiangru, another denizen of China’s capital. 

“People have less guaranteed income than before, so they don’t want to spend money on desired products at such a specific moment.”

China is the last major economy wedded to a strategy of extinguishing new outbreaks as they occur.

State media reported Thursday that top leaders had again vowed to stick “unswervingly” to the policy.

Russian hackers carried out a cyberattack on a major Australian healthcare company that breached the data of 9.7 million people, including the country’s prime minister, police said Friday.

The hackers started leaking the data this week after Medibank, the country’s largest health insurer, refused to pay a $9.7 million (Aus$15 million) ransom.

Australian Federal Police commissioner Reece Kershaw blamed the attack on Russia-based “cyber criminals”. 

“We believe those responsible for the breach are in Russia,” he told reporters.

“Our intelligence points to a group of loosely affiliated cyber criminals who are likely responsible for past significant breaches across the world.”

The hackers have been drip-feeding the stolen data to a dark web forum.

The first leaks appeared to have been selected to cause maximum harm: targeting those who received treatment related to drug abuse, sexually transmitted infections, or pregnancy terminations.

Kershaw said the hackers also appeared to be supported by people living outside Russia.

“These cyber criminals are operating like a business with affiliates and associates who are supporting the business.

“We also believe that some affiliates may be in other countries.”

He added that Australian police would be working with Interpol and seeking the cooperation of their counterparts in Russia.

“We’ll be holding talks with Russian law enforcement about these individuals,” he said.

“Russia benefits from the intelligence sharing and data shared through Interpol and with that comes responsibilities and accountability.”

– Retaliation threat –

Australia has repeatedly condemned Russia’s invasion of Ukraine and has provided Kyiv with hundreds of millions of dollars in aid and military equipment.

Australia’s foreign intelligence agency in April warned that backing Ukraine could open the country up to reprisals from Russian hackers. 

“Russian-aligned cybercrime groups have threatened to conduct cyber operations in retaliation for perceived cyber offensives against the Russian government,” the Australian Signals Directorate said in an advisory note. 

“Some groups have also threatened to conduct cyber operations against countries and organisations providing materiel support to Ukraine.”

Kershaw said police knew the identities of the hackers but he would not be naming them.

Cybersecurity analysts have suggested they could be linked to Russian hacker group REvil. 

REvil — an amalgam of ransomware and evil — was reportedly dismantled by Russian authorities earlier this year, after extracting an $11 million ransom from JBS Foods, a major food conglomerate. 

– ‘Rolled gold mongrels’ –

Australian National University cybersecurity expert Thomas Haines said tracking the hackers down was the easiest part for police.

“It’s unusual for hackers to cover their tracks so well that you don’t know where they came from,” he told AFP. 

“But there are certain areas of the world where the ability to apply any pressure is effectively zero.”

Kershaw said Australian police were taking “covert measures” to bring the hackers to justice. 

“To the criminals, you know we know who you are,” he said. 

“The Australian Federal Police has some significant runs on the scoreboard when it comes to bringing overseas offenders back to Australia to face the justice system.”

Education Minister Jason Clare on Friday called the hackers “rolled gold mongrels”, while Home Affairs Minister Clare O’Neil has dubbed them “scummy criminals”.

O’Neil on Thursday said the “smartest and toughest” people in Australia were hunting down the hackers.

In a taunting reply posted to the dark web early Friday morning, the hackers said: “We always keep our word.” 

“We should post this data, because nobody will believe us in the future.”

The Japanese government will pour half a billion dollars into a new project to develop and make next-generation microchips, chief cabinet secretary Hirokazu Matsuno said Friday.

Eight major companies including Sony, SoftBank, Toyota and telecoms giant NTT have joined forces for the venture, Japanese media reports said.

The new firm, named Rapidus, will develop and mass produce next-generation semiconductors by 2027, according to major media outlets including national broadcaster NHK and the Mainichi Shimbun.

The pandemic has fuelled a global shortage of memory chips, with governments scrambling to secure supplies as carmakers and tech companies have been forced to make production cuts.

Each company has invested around one billion yen ($7 million), with MUFG Bank investing 300 million yen, according to the industry ministry. 

The investor companies are expected to officially announce the project later on Friday. 

The ministry will grant 70 billion yen to Rapidus to lead a research and development project for next-generation semiconductors, Matsuno said without elaborating.

“Semiconductors are a key technology that supports digitalisation and decarbonisation,” Matsuno said at a regular briefing.

“We hope these steps will help improve the competitiveness of our country’s semiconductor industry.”

The chip shortage has prompted calls for the government and businesses to secure semiconductor supplies for Japan’s economic security, as geopolitics become increasingly volatile — especially concerning Taiwan, which has a huge chip-producing capacity.

The United States recently introduced new measures to limit China’s access to high-end semiconductors with military uses, a move that has wiped billions from chip companies’ valuations worldwide.

The German economy ministry also has recommended that the sale of a chip factory to a Chinese-owned firm should be blocked as it poses a security threat, government sources said Tuesday.

Last year, Taiwanese chip giant TSMC and Sony said they would tie up on a new $7 billion plant in Japan.