Consolidated Major Australian Data Breaches Thread

This is what it's about.
It's not about targetting anything specific, it's about getting a massive chunk of data to throw into their brute force scripts etc.

 

even best case - article says the passwords were bcrypt'd which is a good password hash algorithm (assuming they didn't mess up the implementation leaving it weaker than it should be) - everyone of those 31m users will be getting more spam.

 

yeah, but why sit there and DDOS the site for days already ....

 

It's hit the main media;

https://www.abc.net.au/news/2024-10-11/internet-archive-hacked-digital-history/104461930



JSmith

 

Low hanging fruit.
They only function by grants and donations apparently, so makes sense security/DDOS protection wasn't up to scratch.

 

Selby Acoustics got popped...

 

https://www.theregister.com/2024/10/01/australian_digidirect_info_leak/

 

Don’t think I’ve ever bought directly from them but I did recently order from their eBay store… will see if they stored my info from the eBay store I guess

 

Same. Guess I'll wait for another HIBP notification...

Got one about AlpineReplay yesterday - although the breach was back in 2019...

 

Australian e-tailer digiDirect customers' info allegedly stolen and dumped online
https://www.theregister.com/2024/10/01/australian_digidirect_info_leak/6

Full names, contact details, and company info – all the fixings for a phishing holiday
Data allegedly belonging to more than 304,000 customers of Australian camera and tech e-tailer digiDirect has been leaked to an online cyber crime forum.

There has been no word yet from digiDirect, nor from the Office of the Australian Information Commissioner or the Oz Federal Police as to whether they have received a breach report from the electronics shop, or if they are investigating. Anyone who has recently purchased electronics from the shop would be wise to keep an eye on their digital identity and bank accounts to ensure that fraudsters aren't using personal and financial information for shopping sprees or other nefarious purposes.

 

https://www.abc.net.au/news/2024-11-08/optus-pays-12-million-fine-for-triple-zero-outage/104575886

They did need the book thrown at them, so not defending Optus here as such. However it was Govt bodies that allowed Optus and other private entities to handle critical infrastructure... maybe they should fine themselves too.



JSmith

 

https://www.abc.net.au/news/2024-11-12/alleged-hackers-arrested/104590598

JSmith

 

https://www.cyberdaily.au/security/...nfirms-data-incident-customer-data-unaffected

Not customer data apparently.

 

yeah, we (employees) were told that it was employee names, employee email, and employee phone numbers. Glad to see we've learnt from Optus

 

We have learned from Optus. We've learned that it's important to say that we've learned from Optus and are taking appropriate steps.

 

PID obfuscation for test data sets, must be something new and obscure...

look at the decision register to see what mangalment idiot approved the use of live PID data and let people sue them.

 

Last few days Been getting “You entered the incorrect sign in details too many times. Your account is locked.” from MyGOV (they are legit because when I log in, it has the notification)

besides changing passwords (and adding passkey), and having 2FA, there is nothing that can be done?

 

get a new user ID ??

 

damn, they gotta close my account and then sign up again and relink all my services

 

yeah, but at least the crooks stop knocking on the door (for a while) ...