Tech Talks With Kinsoft

In May 2026, Instructure disclosed a cyber security incident affecting Canvas, the learning management platform used widely across Australian universities, vocational providers and schools. In this episode of Tech Talks with Kinsoft, we cover the categories of data involved — names, email addresses, student ID numbers and messages between users — Instructure's statement that it found no evidence passwords, dates of birth, government IDs or financial information were taken, the scale of the impact on Australian education, and the OAIC and institutional response, including guidance for affected students and staff.

Reviewing your own vendor and platform security? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: OAIC; University of Canberra.

Your Monday catch-up, with a security lens. This week: OpenAI loosens its Microsoft exclusivity and goes live on AWS, and Big Tech's quarterly earnings push combined AI spending toward $650–700B for the year. On the breach desk: the ShinyHunters Salesforce-theft wave rolls on through Amtrak, Pitney Bowes and Vimeo, while a Hungarian media giant loses 8.5 terabytes.

Worried about what's connected to your Salesforce or CRM? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: CNBC; TechCrunch; VentureBeat; Quartz; Fortune; CM-Alliance.

France's ANTS (Agence nationale des titres sécurisés / France Titres), the Interior-Ministry body managing ID cards, passports, driver's licences and immigration documents, detected a security incident around 15 April 2026 on its ants.gouv.fr portal. ANTS confirmed about 11.7 million accounts were impacted (a threat actor claimed up to 19 million). Exposed data reportedly included full names, contact details, dates of birth, home addresses and civil-status information. Researchers traced it to a basic Insecure Direct Object Reference (IDOR) flaw in the ANTS API; ANTS notified the CNIL, ANSSI and the Paris prosecutor. We explain IDOR in plain terms and the identity-theft risk.

Building or running citizen-facing portals and APIs? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: TechCrunch; Help Net Security.

In April 2026, the Kairos ransomware group claimed responsibility for breaching Gregory Jewellers, an Australian family-owned luxury jewellery retailer, alleging it stole roughly 574GB of data and listing the company on its dark web leak site. In this episode of Tech Talks with Kinsoft, we cover what the attackers say they took — client personal information, internal corporate records and customer details — how Kairos has been targeting Australian organisations, and the company's response as it works with specialists and notifies authorities and affected customers.

Concerned about ransomware and data theft in your business? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: Cyber Daily.

Your Monday catch-up, with a security lens. This week: Meta cuts around 8,000 jobs to fund its AI build-out. On the breach desk it's a heavy week — Medtronic confirms a breach via an SEC filing, the Everest gang leaks two US banks through a shared vendor, North Korea-linked attackers pull off a $290M crypto heist, and ADT confirms customer data was stolen.

Is a shared third-party vendor a hole in your defences? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: Quartz; Axios; HIPAA Journal; TechCrunch; CM-Alliance.

Home-security firm ADT detected unauthorized access around 20 April 2026; the breach became public when extortion group ShinyHunters listed ADT on its leak site on 24 April with a pay-or-leak deadline. The confirmed breach affected about 5.5 million people — emails, names, phone numbers and addresses, and in a small percentage of cases dates of birth and the last four digits of SSN/Tax IDs. The attack reportedly began with a vishing call impersonating IT support to capture Okta single-sign-on credentials, then reached the company's Salesforce data. We cover the human-layer vishing risk and SSO exposure.

Concerned your help desk could be social-engineered? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: BleepingComputer; BankInfoSecurity.

In April 2026, NSW Treasury disclosed a significant insider data breach: a staffer on its commercial team allegedly exfiltrated more than 5,600 sensitive government documents to an external server. In this episode of Tech Talks with Kinsoft, we cover how internal security monitoring flagged the suspicious transfer, the involvement of NSW Police, the arrest and charges, the confidential commercial and financial information involved, and the government's coordinated response — including that the data was recovered and public services were not disrupted.

Worried about insider risk and data loss in your own organisation? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: iTnews; Cyber Daily.

Your Monday catch-up, with a security lens. This week: Microsoft's Patch Tuesday fixes 167 flaws including two zero-days, Rockstar Games is breached through a third-party vendor, Amazon bids $11.6B for a satellite operator to take on Starlink, and Snap cuts a sixth of its staff citing AI.

Are you patching the flaws attackers are already using? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: BleepingComputer; Krebs on Security; Tom's Hardware; TechCrunch; CNBC; Reuters.

Around 13 April 2026 Booking.com began notifying customers that unauthorized third parties had accessed guest reservation data — not by breaching Booking.com directly, but by compromising hotel partner accounts (researchers point to ClickFix phishing of hotel staff, attributed to a group tracked as Storm-1865). Exposed data included booking details, names, email and physical addresses and phone numbers; financial information was not accessed. Criminals quickly used the details in convincing WhatsApp and SMS phishing referencing guests' real hotel, dates and booking references. We cover third-party and supply-chain risk and how to spot these scams.

Worried about partner and supply-chain access to your data? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: TechCrunch; Help Net Security.

The Space Bears ransomware group listed Melbourne financial-services firm 3P Corporation in early April 2026 (post dated 10 April; incident said to be 7 April), claiming 200 GB+ including a database, financial documents and personal information of employees and clients. 3P disputes this — it told Cyber Daily its systems stopped the attack before data was compromised. We present both sides and how to weigh contested leak-site claims.

Hold sensitive client data in a small firm? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: Cyber Daily; Accountants Daily.