432.3 Real-world case studies

Examine real-world examples of software failures and security breaches — and reflect on what could have been done differently.

Targets

• Analyse real-world software and security failures

• Reflect on ethical, legal and collaborative breakdowns in practice

• Apply your understanding of professional responsibilities to real scenarios

Secure software architecture

• Evaluate the social, ethical and legal issues and ramifications that affect people and enterprises resulting from the development and implementation of safe and secure software, including: – employment – data security – privacy – copyright – intellectual property – digital disruption

Impacts of insecure software

Insecure software can have wide-ranging consequences affecting individuals, businesses, and society. Understanding these impacts helps highlight why secure software development practices are crucial. Below are the main social, ethical, and legal issues associated with insecure software, enriched with Australian examples and case studies.

Employment

The rise in cyberattacks has reshaped employment landscapes, both positively and negatively. On the one hand, data breaches and software vulnerabilities can lead to job losses within affected companies due to financial strain. On the other hand, they fuel demand for skilled cybersecurity professionals, driving growth in that sector.

The 2022 Optus data breach, one of Australia’s largest, led to significant company upheaval and urgent investments in cybersecurity. While the breach harmed the company’s reputation and caused widespread disruptions, it underscored the growing need for cybersecurity jobs, promoting investment in training programs for Australian professionals.

The cybersecurity job market in Australia has seen a spike, with reports indicating that thousands of jobs remain unfilled as organisations focus on preventing future breaches.

Optus Data Breach

In September 2022, Optus, one of Australia's largest telecommunications providers, suffered a significant data breach that exposed the personal data of approximately 9.8 million customers. The breach was attributed to an exploited vulnerability in an unsecured API, which allowed attackers to access customer information without authentication. The exposed data included names, addresses, phone numbers, email addresses, and, for some users, sensitive information such as passport and driver’s license numbers.

Optus faced significant backlash from public and government officials due to perceived gaps in its data security protocols. The Australian Government introduced measures to support affected customers, such as expedited document replacements and enhanced data protection policies. This breach led to discussions about strengthening cybersecurity regulations in Australia and ensuring companies take greater responsibility for securing customer data.

Upguard - How did the Optus data breach happen?

Data Security

Data security is fundamental to protecting personal and enterprise information from unauthorised access. Breaches due to insecure software can compromise sensitive data, leading to financial, legal, and reputational damage.

In 2018, Australian health provider HealthEngine experienced a breach where patient data was shared with law firms without explicit consent. This incident sparked discussions on data handling ethics and compliance with the Privacy Act 1988. The breach highlighted vulnerabilities in managing personal health information, prompting stricter data security measures.

The Australian Government’s Notifiable Data Breaches (NDB) scheme mandates that organisations report data breaches likely to cause serious harm. This scheme increases accountability and awareness about data security risks.

HealthEngine Data Breach

In 2020, HealthEngine, Australia’s largest online medical appointment service, faced a significant fine of $2.9 million after the Australian Competition and Consumer Commission (ACCC) found it had engaged in misleading conduct. Between 2014 and 2018, HealthEngine provided personal data—including names, dates of birth, phone numbers, and emails—of over 135,000 patients to private health insurance brokers without adequately informing or obtaining consent from those individuals. Additionally, HealthEngine was found to have manipulated or selectively published patient reviews to present health providers more favourably, impacting patient choices based on incomplete or edited feedback.

This breach raised serious concerns about transparency and consumer rights under the Australian Consumer Law (ACL), highlighting the ethical and privacy implications of data misuse by digital platforms. Following the investigation, HealthEngine was required to inform affected users and overhaul its data handling and transparency practices.

Addisons - Privacy Protection: HealthEngine hit with $2.9 Million Fine for Misuse of Customer Data

Privacy

Privacy is deeply intertwined with data security. Insecure software can lead to the unauthorised exposure of personal information, violating individuals' privacy rights and trust in organisations.

The Medibank cyberattack in 2022 affected millions of Australians. Hackers accessed highly sensitive personal data, including medical histories, leading to significant privacy concerns. This incident highlighted how healthcare providers protect patient data and maintain confidentiality.

The Privacy Act 1988 and the Australian Privacy Principles (APPs) set strict rules for organisations collecting, using, and managing personal information. Breaches can result in severe penalties, reinforcing the need for robust security measures to uphold privacy.

Medibank Cyberattack

In October 2022, Medibank, a leading Australian health insurer, detected suspicious activity within its network, eventually exposing personal and sensitive data from 9.7 million current and former customers. The compromised information included names, dates of birth, Medicare and passport numbers, and health claim details. This breach had severe implications for customer privacy and raised significant concerns about how sensitive health data is protected.

The attackers, believed to be affiliated with the BlogXX ransomware group, threatened to release the data if Medibank did not comply with their ransom demand of USD $10 million. Medibank refused to pay the ransom, citing ethical and practical reasons, including the risk of incentivising future attacks. The hackers began releasing segments of the stolen data on the dark web.

The breach prompted Medibank to engage cybersecurity experts and collaborate with Australian regulatory bodies, including the Australian Cyber Security Centre (ACSC), to mitigate the damage and enhance security measures.

UpGuard - What caused the Medibank Data breach

Copyright and Intellectual Property

Software vulnerabilities can lead to intellectual property theft, which has legal and ethical implications. When proprietary code or content is stolen, it can disrupt businesses, reduce competitive advantage, and stifle innovation.

In 2020, Australian company Lion, known for food and beverage products, faced a ransomware attack that halted its production and distribution. While data and operational disruptions were more publicly visible, the event underscored the risk to proprietary systems and content. Attacks like this can expose software code or patented processes, impacting future business prospects.

Organisations must implement stringent access control and encryption to protect intellectual property from exposure during such attacks.

Lion Ransomware Attack

This attack disrupted Lion’s manufacturing and customer service operations. The company disclosed that ransomware had infiltrated their systems, leading to a partial IT shutdown. This disruption affected their ability to produce and distribute beer and dairy products, causing temporary shortages and operational delays. Although Lion did not initially find evidence of data theft, the hackers threatened to release stolen data unless a ransom was paid, showcasing a double extortion tactic often used in ransomware attacks.

SecurityWeek - Ransomware Disrupts Production at Lion

Digital Disruption

Digital disruption occurs when technology changes the landscape of an industry, often driven by technological advancements or vulnerabilities. Insecure software can exacerbate this disruption by making it easier for cyberattacks to affect critical services.

In 2016, a distributed denial-of-service (DDoS) attack disrupted Australian government services, including those of the Australian Bureau of Statistics (ABS) during the census. This incident, dubbed the “Census Fail,” highlighted how digital disruption could arise from insufficient protection against cyberattacks. The inability to secure crucial services inconvenienced millions and posed risks to data collection and public trust.

The attack forced significant policy changes and investment in cybersecurity, showcasing the importance of proactive security measures in preventing digital disruption.

ABS Census Fail

On August 9, 2016, the ABS's online Census form experienced multiple distributed denial-of-service (DDoS) attacks, disrupting services and taking the system offline for approximately 40 hours. The decision to shut down the service was made to ensure data protection amidst potential threats. This incident, known as “Census Fail,” affected millions of Australians who could not complete their Census online, impacting public trust in the ABS and raising questions about the government's cybersecurity preparedness.

Although there were conflicting views on whether the primary issue was solely a DDoS attack or a combination of high traffic and insufficient technical preparation, it was clear that no personal data was compromised or accessed during the incident. This event highlighted significant vulnerabilities in handling large-scale, public-facing digital services and underscored the need for improved cybersecurity measures.

The New Daily - How the ABS bungled Census 2016