WEBVTT 00:00:00.000 --> 00:00:02.140 You know, usually when we talk about a massive 00:00:02.140 --> 00:00:04.339 corporate disaster like a bank heist or something, 00:00:04.500 --> 00:00:08.179 there is this expectation of, well, obvious destruction. 00:00:08.500 --> 00:00:10.800 Right. Like it's highly visible. Yeah, exactly. 00:00:10.939 --> 00:00:13.660 You picture the blown open vault, the alarms 00:00:13.660 --> 00:00:16.940 blaring, the empty safe deposit boxes. The authorities 00:00:16.940 --> 00:00:19.000 walk in, point at the giant hole in the wall 00:00:19.000 --> 00:00:21.859 and say, well, there it is. That is what they 00:00:21.859 --> 00:00:24.579 took. There's a clear crime scene, an obvious 00:00:24.579 --> 00:00:27.140 point of entry and a quantifiable loss that, 00:00:27.160 --> 00:00:29.219 you know, everyone can immediately understand. 00:00:29.690 --> 00:00:32.409 But imagine you arrived at that exact same bank 00:00:32.409 --> 00:00:35.229 and the vault was perfectly intact. I mean, not 00:00:35.229 --> 00:00:37.969 a single dollar missing. No alarms tripped. Right. 00:00:38.070 --> 00:00:40.649 No alarms. The safety deposit boxes haven't even 00:00:40.649 --> 00:00:43.710 been breathed on. But the bank manager was so 00:00:43.710 --> 00:00:46.829 spooked by like a shadow near the back door that 00:00:46.829 --> 00:00:49.189 they intentionally welded the front door shut. 00:00:49.390 --> 00:00:52.570 They turned off all the ATMs. Yeah. just stopped 00:00:52.570 --> 00:00:54.829 letting anyone make a withdrawal or deposit for 00:00:54.829 --> 00:00:57.710 two entire weeks. Which would effectively crash 00:00:57.710 --> 00:00:59.710 the bank's operations, right? I mean, it would 00:00:59.710 --> 00:01:02.270 cause a massive financial panic. Completely. 00:01:02.409 --> 00:01:04.629 Even though the robbers themselves didn't actually 00:01:04.629 --> 00:01:07.390 steal a single cent or break a single lock. It 00:01:07.390 --> 00:01:09.930 completely flips our traditional understanding 00:01:09.930 --> 00:01:12.810 of what a security breach actually looks like 00:01:12.810 --> 00:01:15.189 in practice. And that is exactly what we are 00:01:15.189 --> 00:01:17.719 getting into today. Welcome to the Deep Dive. 00:01:17.739 --> 00:01:20.159 We are thrilled to have you with us as we explore 00:01:20.159 --> 00:01:23.359 a cybersecurity incident that defies absolutely 00:01:23.359 --> 00:01:25.799 everything we have come to expect about how cyber 00:01:25.799 --> 00:01:28.459 attacks work. It really does challenge all the 00:01:28.459 --> 00:01:31.620 assumptions. It does. So our source material 00:01:31.620 --> 00:01:34.239 for this deep dive comes from a September 25th, 00:01:34.239 --> 00:01:37.200 2026 catch -up edition of Tech Talks with Kinsoft. 00:01:37.500 --> 00:01:39.739 And our mission today is to understand how a 00:01:39.739 --> 00:01:42.680 massive global medical device maker lost two 00:01:42.680 --> 00:01:45.040 weeks of manufacturing and shipping. They completely 00:01:45.040 --> 00:01:47.879 tanked their quarter. Yes. And yet no data was 00:01:47.879 --> 00:01:51.540 stolen and no files were encrypted. Okay, let's 00:01:51.540 --> 00:01:54.310 unpack this. Well, it requires a fundamental 00:01:54.310 --> 00:01:56.750 shift in perspective. You know, we have been 00:01:56.750 --> 00:02:00.069 conditioned by the media and by past high profile 00:02:00.069 --> 00:02:03.230 incidents to associate cyber attacks with digital 00:02:03.230 --> 00:02:06.769 hostage situations. Oh, totally. We expect ransomware 00:02:06.769 --> 00:02:09.789 extortion. Exactly. We expect leaked databases 00:02:09.789 --> 00:02:12.889 and ruined hard drives. But this case reveals 00:02:12.889 --> 00:02:15.189 a completely different kind of vulnerability. 00:02:15.590 --> 00:02:17.990 Which is what makes it so fascinating. Right. 00:02:18.069 --> 00:02:20.490 It's one where the sheer fear of the unknown. 00:02:20.990 --> 00:02:23.550 And the actual protocols designed to protect 00:02:23.550 --> 00:02:26.250 a company become the destructive mechanism itself. 00:02:26.610 --> 00:02:29.090 So the company at the center of this is Boston 00:02:29.090 --> 00:02:31.889 Scientific. And to really grasp the gravity of 00:02:31.889 --> 00:02:33.729 a two -week shutdown, you kind of have to understand 00:02:33.729 --> 00:02:36.210 the sheer footprint of this giant. Right. This 00:02:36.210 --> 00:02:39.710 isn't some niche regional supplier with a warehouse 00:02:39.710 --> 00:02:42.090 in the suburbs. Not at all. I mean, they are 00:02:42.090 --> 00:02:43.949 based in Massachusetts, but they have roughly 00:02:43.949 --> 00:02:48.250 59 ,000 employees. Spread across more than 120 00:02:48.250 --> 00:02:51.159 countries. Yeah, and according to the HIPAA Journal, 00:02:51.259 --> 00:02:54.240 their medical devices are used by around 48 million 00:02:54.240 --> 00:02:56.840 patients every single year. We are talking about 00:02:56.840 --> 00:03:00.039 critical, life -altering hardware here. Specialized 00:03:00.039 --> 00:03:03.240 cardiac stents, advanced surgical products, neurological 00:03:03.240 --> 00:03:06.300 modulators. Stuff you kind of need. Right. These 00:03:06.300 --> 00:03:08.719 are devices that hospitals literally cannot function 00:03:08.719 --> 00:03:11.080 without. And crucially, most of what they sell 00:03:11.080 --> 00:03:13.939 is single -use. Like, the surgeon opens the sterile 00:03:13.939 --> 00:03:16.280 packaging, uses the device during a procedure, 00:03:16.360 --> 00:03:18.960 and then it is disposed of. It has to be replaced 00:03:18.960 --> 00:03:21.199 by a brand new one for the next patient. Exactly. 00:03:21.439 --> 00:03:24.659 So it is this high -volume, constant -flow supply 00:03:24.659 --> 00:03:27.639 chain. Because hospitals do not have the physical 00:03:27.639 --> 00:03:30.860 space or the budgets to stock infinite supplies 00:03:30.860 --> 00:03:33.819 of these specialized, single -use devices. They 00:03:33.819 --> 00:03:36.159 operate on a just -in -time inventory model. 00:03:36.419 --> 00:03:38.319 Right. They rely on a steady, mathematically 00:03:38.319 --> 00:03:40.419 predictable rhythm of shipping and fulfillment 00:03:40.419 --> 00:03:43.060 from the manufacturer. If a product is delayed, 00:03:43.300 --> 00:03:46.259 surgeries get canceled. It is really that simple. 00:03:46.729 --> 00:03:49.550 So keep that incredibly fragile, high stakes 00:03:49.550 --> 00:03:51.830 rhythm in mind as we look at the reality of this 00:03:51.830 --> 00:03:54.050 disruption. The pressure doesn't just build overnight. 00:03:54.110 --> 00:03:58.270 It compounds. It really snowballs. Based on U 00:03:58.270 --> 00:04:02.250 .S. time, on August 25th, an alert pops up. Boston 00:04:02.250 --> 00:04:04.750 Scientific detects what it broadly calls, quote, 00:04:04.870 --> 00:04:07.889 system availability issues, unquote, across parts 00:04:07.889 --> 00:04:11.050 of its network. And they trace it to an unauthorized 00:04:11.050 --> 00:04:14.379 third party. Right. They immediately begin containment 00:04:14.379 --> 00:04:16.639 protocols and bring in the cybersecurity heavy 00:04:16.639 --> 00:04:19.339 hitters CrowdStrike to investigate. And within 00:04:19.339 --> 00:04:22.319 hours, this digital anomaly translates into physical 00:04:22.319 --> 00:04:25.500 paralysis. Yeah. Over in Ireland, local media 00:04:25.500 --> 00:04:28.480 reports that staff at Boston Scientific's massive 00:04:28.480 --> 00:04:31.959 court campus are suddenly sent home. What's fascinating 00:04:31.959 --> 00:04:34.920 here is how the physical manifestation of a digital 00:04:34.920 --> 00:04:38.079 threat is just so immediate. Yes. An analyst 00:04:38.079 --> 00:04:40.879 in a security operations center sees an anomalous 00:04:40.879 --> 00:04:43.360 connection. And thousands of miles away, real 00:04:43.360 --> 00:04:45.220 people are walking out of physical manufacturing 00:04:45.220 --> 00:04:48.279 plants. The assembly lines building pacemakers 00:04:48.279 --> 00:04:51.160 just halt. The sterilization chambers power down. 00:04:51.439 --> 00:04:54.420 The lights are essentially turned off. It highlights 00:04:54.420 --> 00:04:57.019 how utterly tethered the physical manufacturing 00:04:57.019 --> 00:05:00.420 world is to its digital nervous system. Because 00:05:00.420 --> 00:05:02.180 without the network to tell the machines what 00:05:02.180 --> 00:05:04.220 to build or the shipping software to print the 00:05:04.220 --> 00:05:06.500 labels, the factory is just an expensive empty 00:05:06.500 --> 00:05:09.949 shell. Exactly. And over the next week, the momentum 00:05:09.949 --> 00:05:13.769 of the crisis just snowballs. It is not a matter 00:05:13.769 --> 00:05:15.790 of simply turning the servers back on the next 00:05:15.790 --> 00:05:18.589 morning. No, it takes until September 3rd through 00:05:18.589 --> 00:05:21.269 the 5th for shipping to even slowly start resuming 00:05:21.269 --> 00:05:23.670 from their major distribution centers. Right. 00:05:23.750 --> 00:05:26.009 The sterilization sites finally come back online. 00:05:26.290 --> 00:05:29.629 And manufacturing slowly spins back up. Because 00:05:29.629 --> 00:05:31.829 restarting a global manufacturing operation is 00:05:31.829 --> 00:05:33.850 agonizingly complex. It isn't a light switch. 00:05:34.230 --> 00:05:37.250 Not at all. When you sever a network unceremoniously, 00:05:38.020 --> 00:05:41.060 Databases get corrupted. Inventory systems lose 00:05:41.060 --> 00:05:43.579 sync with the physical warehouse shelves. Robotic 00:05:43.579 --> 00:05:46.139 assembly lines have to be recalibrated. Yeah, 00:05:46.180 --> 00:05:48.579 and software has to be carefully, methodically 00:05:48.579 --> 00:05:51.720 brought back online, segment by segment. You 00:05:51.720 --> 00:05:54.019 have to ensure the intruder isn't hiding in a 00:05:54.019 --> 00:05:57.480 reboot script. It's like a massive global train 00:05:57.480 --> 00:05:59.920 network slamming on the emergency brakes, all 00:05:59.920 --> 00:06:02.740 at exactly the same time, you know? Oh, that's 00:06:02.740 --> 00:06:04.939 a good way to put it. Like the sheer violent 00:06:04.939 --> 00:06:07.920 inertia of stopping is one thing. But getting 00:06:07.920 --> 00:06:11.040 it going again, you have to manually inspect 00:06:11.040 --> 00:06:14.199 every single mile of track. Coordinate every 00:06:14.199 --> 00:06:17.500 single automated signal. Yeah, and slowly build 00:06:17.500 --> 00:06:19.819 up the steam before those incredibly heavy trains 00:06:19.819 --> 00:06:23.100 can start moving safely. And while they are slowly 00:06:23.100 --> 00:06:25.879 getting those trains moving, the financial reality 00:06:25.879 --> 00:06:28.639 sets in. Right. On September 7th and 8th, the 00:06:28.639 --> 00:06:31.379 pressure culminates in a formal material cyber 00:06:31.379 --> 00:06:33.939 incident report filed with the SEC. They have 00:06:33.939 --> 00:06:35.980 to officially warn Wall Street that this disruption 00:06:35.980 --> 00:06:38.720 is so severe, they are going to miss their financial 00:06:38.720 --> 00:06:41.120 guidance for the quarter. And for the entire 00:06:41.120 --> 00:06:43.980 year. And with a new outlook scheduled for October 00:06:43.980 --> 00:06:47.439 28th, Quartz reports that shares fell over 4 00:06:47.439 --> 00:06:50.759 % on the news. Though, to be fair, the stock 00:06:50.759 --> 00:06:53.139 was already navigating a rough year for unrelated 00:06:53.139 --> 00:06:56.639 macroeconomic reasons. Sure. But finally, on 00:06:56.639 --> 00:06:59.360 September 9th, two full weeks after the initial 00:06:59.360 --> 00:07:01.759 alert, order fulfillment, manufacturing, and 00:07:01.759 --> 00:07:04.480 shipping are declared fully restored. Two weeks 00:07:04.480 --> 00:07:08.339 of severe operational degradation. Yeah. Normally, 00:07:08.339 --> 00:07:10.420 when a massive enterprise goes dark for half 00:07:10.420 --> 00:07:12.699 a month, we assume the attackers utterly destroyed 00:07:12.699 --> 00:07:15.079 the internal infrastructure. We assume the servers 00:07:15.079 --> 00:07:17.579 are melted slag and the databases are scrambled 00:07:17.579 --> 00:07:19.879 with military -grade encryption. But the forensic 00:07:19.879 --> 00:07:22.319 investigation tells a completely different story. 00:07:22.879 --> 00:07:24.879 CrowdStrike finishes their analysis by September 00:07:24.879 --> 00:07:27.620 18th, and the summary goes public on the 23rd 00:07:27.620 --> 00:07:29.720 Australian time. And the findings are defined 00:07:29.720 --> 00:07:32.819 entirely by what did not happen. Yeah, this part 00:07:32.819 --> 00:07:35.959 is wild. the investigators proved a massive almost 00:07:35.959 --> 00:07:38.819 confusing absence of malicious activity they 00:07:38.819 --> 00:07:41.720 found Absolutely zero evidence of data encryption. 00:07:42.019 --> 00:07:45.060 No activity in Microsoft 365 or their corporate 00:07:45.060 --> 00:07:48.160 email. Right. No interactive access to HR systems, 00:07:48.360 --> 00:07:50.660 manufacturing systems, industrial control systems, 00:07:50.699 --> 00:07:53.199 or research and development. There were no application 00:07:53.199 --> 00:07:55.500 -level logins to massive enterprise tools like 00:07:55.500 --> 00:07:58.019 SAP, Salesforce, or any of their cloud apps. 00:07:58.279 --> 00:08:01.220 And the absolute biggest sigh of relief, no patient 00:08:01.220 --> 00:08:04.519 or customer data was accessed, staged for exfiltration, 00:08:04.519 --> 00:08:07.810 or taken. Even the existing implanted heart devices 00:08:07.810 --> 00:08:10.569 out there in the world and their monitoring systems 00:08:10.569 --> 00:08:13.389 were completely untouched. Though I think new 00:08:13.389 --> 00:08:15.870 activations for cardiac remote monitoring were 00:08:15.870 --> 00:08:18.750 temporarily disrupted. Yes, temporarily. But 00:08:18.750 --> 00:08:20.889 overall, the environment was pristine. Aside 00:08:20.889 --> 00:08:23.310 from the initial unauthorized entry at the perimeter, 00:08:23.470 --> 00:08:26.009 the attackers did nothing. In technical terms, 00:08:26.129 --> 00:08:28.410 there was no lateral movement. Okay, so lateral 00:08:28.410 --> 00:08:30.730 movement being the attacker's ability to hop 00:08:30.730 --> 00:08:32.870 from the initial break -in point over to the 00:08:32.870 --> 00:08:35.370 really valuable stuff. Exactly. When an attacker 00:08:35.370 --> 00:08:37.870 breaches a network edge, they usually land in 00:08:37.870 --> 00:08:41.009 an unprivileged zone. To do real damage, they 00:08:41.009 --> 00:08:43.610 have to move laterally. Meaning they search for 00:08:43.610 --> 00:08:45.830 internal vulnerabilities, steal administrative 00:08:45.830 --> 00:08:49.289 credentials, stuff like that? Yeah. And hopping 00:08:49.289 --> 00:08:51.730 from server to server until they reach the quote 00:08:51.730 --> 00:08:54.389 -unquote crown jewels, like the customer database 00:08:54.389 --> 00:08:57.529 or the core financial systems. So in this case, 00:08:57.529 --> 00:08:59.370 the attackers essentially broke into the foyer, 00:08:59.450 --> 00:09:01.629 couldn't figure out how to open any of the interior 00:09:01.629 --> 00:09:04.840 doors, and just stood there? Pretty much. Furthermore, 00:09:05.059 --> 00:09:07.220 no credible threat group even claimed responsibility. 00:09:08.039 --> 00:09:10.740 Really? Nobody tried to take credit. Well, the 00:09:10.740 --> 00:09:12.580 HIPAA Journal actually had to issue a correction 00:09:12.580 --> 00:09:15.399 after initially linking it to a ransomware group 00:09:15.399 --> 00:09:18.600 called Shiny Hunters. Oh, right. And a separate 00:09:18.600 --> 00:09:21.000 claim by a pro -Russian hacktivist group was 00:09:21.000 --> 00:09:23.820 completely unsubstantiated. There wasn't even 00:09:23.820 --> 00:09:27.039 a known CVE, a common vulnerability and exposure, 00:09:27.279 --> 00:09:30.700 linked to the breach. Wait, hold on. I'm looking 00:09:30.700 --> 00:09:34.389 at this list of untouched systems. If no patient 00:09:34.389 --> 00:09:36.610 data was stolen, no files were encrypted, no 00:09:36.610 --> 00:09:38.549 ransomware deployed, and the cloud apps were 00:09:38.549 --> 00:09:40.769 perfectly fine, why on earth did the company 00:09:40.769 --> 00:09:43.750 panic and stay down for two weeks? It's a great 00:09:43.750 --> 00:09:46.129 question. I mean, why suffer all that financial 00:09:46.129 --> 00:09:48.809 damage and shut down the Cork campus if the attackers 00:09:48.809 --> 00:09:51.389 were just standing in the foyer and didn't actually 00:09:51.389 --> 00:09:54.190 break anything? That feels like a massive overreaction. 00:09:54.389 --> 00:09:57.230 It seems like an overreaction until you understand 00:09:57.230 --> 00:10:00.769 the reality of incident response. In today's 00:10:00.769 --> 00:10:03.059 threat landscape. The most devastating operational 00:10:03.059 --> 00:10:05.720 damage isn't always caused by the attacker's 00:10:05.720 --> 00:10:08.960 weapons. Okay, what do you mean? Sometimes it 00:10:08.960 --> 00:10:12.299 is entirely caused by the victim's shield. Meaning 00:10:12.299 --> 00:10:14.639 Boston Scientific essentially did this to themselves? 00:10:14.740 --> 00:10:18.639 Like they caused their own outage? Yes. The two 00:10:18.639 --> 00:10:20.840 -week outage was the direct result of the company's 00:10:20.840 --> 00:10:24.039 own defensive containment strategy. Wow. When 00:10:24.039 --> 00:10:26.220 a security team detects an active, unauthorized 00:10:26.220 --> 00:10:28.950 intruder inside the network, But they don't yet 00:10:28.950 --> 00:10:31.549 have perfect visibility into how deep the intruder 00:10:31.549 --> 00:10:34.570 is or what their intentions are. The standard 00:10:34.570 --> 00:10:37.210 responsible playbook is to immediately sever 00:10:37.210 --> 00:10:40.110 connections. You pull up the drawbridge to prevent 00:10:40.110 --> 00:10:42.690 the lateral movement we just talked about. Exactly. 00:10:42.730 --> 00:10:45.269 You lock it down. Which explains why the CEO, 00:10:45.509 --> 00:10:48.129 Mike Mahoney, stated publicly that all plants 00:10:48.129 --> 00:10:50.230 and distribution centers globally were shut down. 00:10:50.389 --> 00:10:52.909 Not just the specific server that was breached, 00:10:52.950 --> 00:10:56.029 but the entire global physical operation. Right. 00:10:56.460 --> 00:10:58.559 And that happens because of how enterprise networks 00:10:58.559 --> 00:11:01.460 are architected. Modern companies operate in 00:11:01.460 --> 00:11:04.139 a hybrid environment. They have cloud systems 00:11:04.139 --> 00:11:06.460 like Salesforce for customer relationship management 00:11:06.460 --> 00:11:10.120 or Microsoft 365 for email. Which are hosted 00:11:10.120 --> 00:11:13.039 off -site on external servers. Those were perfectly 00:11:13.039 --> 00:11:15.960 safe. But the foundational on -premises systems, 00:11:16.200 --> 00:11:18.600 the localized servers that actually run the factory 00:11:18.600 --> 00:11:20.960 floor manufacturing robots, manage the physical 00:11:20.960 --> 00:11:23.500 warehouse inventory, and process real -time shipping 00:11:23.500 --> 00:11:26.220 orders, those are tightly interconnected. Yes. 00:11:26.320 --> 00:11:28.720 So when the security team realized the intruder 00:11:28.720 --> 00:11:31.779 had touched the on -premises network, they intentionally 00:11:31.779 --> 00:11:35.080 shut those internal systems down to ensure the 00:11:35.080 --> 00:11:37.500 attacker couldn't use them to pivot or deploy 00:11:37.500 --> 00:11:40.279 ransomware. It's like finding a tiny leak in 00:11:40.279 --> 00:11:42.100 the plumbing of your guest bathroom, so you run 00:11:42.100 --> 00:11:43.759 down to the basement and shut off the main water 00:11:43.759 --> 00:11:46.559 valve to the entire house. That is exactly what 00:11:46.559 --> 00:11:49.340 it is like. The house is completely safe from 00:11:49.340 --> 00:11:52.139 flooding, which is great. But now nobody can 00:11:52.139 --> 00:11:54.039 take a shower, you can't run the dishwasher, 00:11:54.340 --> 00:11:56.460 and you can't wash your hands for two weeks while 00:11:56.460 --> 00:11:58.620 you wait for the plumber to meticulously check 00:11:58.620 --> 00:12:01.360 every single pipe to confirm the leak was just 00:12:01.360 --> 00:12:04.440 a loose washer. The cure, in the immediate term, 00:12:04.580 --> 00:12:07.460 genuinely feels as debilitating as the disease. 00:12:08.120 --> 00:12:10.600 If we connect this to the bigger picture, it 00:12:10.600 --> 00:12:12.700 exposes a critical vulnerability in business 00:12:12.700 --> 00:12:15.860 continuity. Yeah, because Boston Scientific successfully 00:12:15.860 --> 00:12:18.360 survived the cyber threat. They protected their 00:12:18.360 --> 00:12:20.960 data, but their revenue stream took a massive 00:12:20.960 --> 00:12:23.840 hit. It demonstrates that knowing exactly which 00:12:23.840 --> 00:12:26.759 on -premises systems your physical business genuinely 00:12:26.759 --> 00:12:29.919 cannot function without is a critical map every 00:12:29.919 --> 00:12:32.259 company needs to draw before an emergency strikes. 00:12:32.539 --> 00:12:35.179 Because the business impact of throwing that 00:12:35.179 --> 00:12:38.860 main water valve is brutal. Oh, absolutely. Analysts 00:12:38.860 --> 00:12:41.220 at J .P. Morgan pointed out a really harsh reality 00:12:41.220 --> 00:12:43.580 for the medical device industry. Remember, these 00:12:43.580 --> 00:12:46.019 are single -use devices. Right. If a hospital 00:12:46.019 --> 00:12:47.960 has a specialized surgery scheduled for Tuesday 00:12:47.960 --> 00:12:51.080 morning and your shipping is halted so the required 00:12:51.080 --> 00:12:53.460 stent doesn't arrive, the hospital doesn't just 00:12:53.460 --> 00:12:56.399 put the patient on hold for two weeks. No, they 00:12:56.399 --> 00:12:59.120 pivot to a competitor's product or they utilize 00:12:59.120 --> 00:13:01.580 an alternative method. So that sale isn't just 00:13:01.580 --> 00:13:03.820 delayed until Boston Scientific gets its servers 00:13:03.820 --> 00:13:06.779 back online. That sale is lost completely. Right. 00:13:07.779 --> 00:13:10.440 The company hopes to recover some of that revenue, 00:13:10.559 --> 00:13:13.580 but a massive chunk of it simply evaporated because 00:13:13.580 --> 00:13:16.919 the factory was forced to hold its breath. Business 00:13:16.919 --> 00:13:19.360 leaders, not just IT departments, have to be 00:13:19.360 --> 00:13:21.460 deeply involved in network architecture decisions 00:13:21.460 --> 00:13:25.220 for this exact reason. Yes. If your critical 00:13:25.220 --> 00:13:27.879 order fulfillment server sits in the same blast 00:13:27.879 --> 00:13:31.360 radius as a vulnerable edge device, your entire 00:13:31.360 --> 00:13:34.799 global revenue stream is at the mercy of your 00:13:34.799 --> 00:13:37.190 own containment protocols. Which brings us to 00:13:37.190 --> 00:13:40.070 how this all started. How did these ghosts even 00:13:40.070 --> 00:13:42.590 get into the foyer in the first place? It wasn't 00:13:42.590 --> 00:13:44.830 an employee clicking on a bad link in a phishing 00:13:44.830 --> 00:13:47.549 email. And it wasn't a stolen laptop left in 00:13:47.549 --> 00:13:50.029 an airport lounge. The initial vector was an 00:13:50.029 --> 00:13:53.169 external facing network management device. We 00:13:53.169 --> 00:13:55.409 don't know the specific vendor and we don't know 00:13:55.409 --> 00:13:58.049 the exact software flaw, but it was essentially 00:13:58.049 --> 00:14:00.210 a piece of hardware sitting on the edge of their 00:14:00.210 --> 00:14:02.740 network. Right. They ended up decommissioning 00:14:02.740 --> 00:14:04.919 the device entirely, blocking the attacker's 00:14:04.919 --> 00:14:07.159 infrastructure, resetting all global passwords, 00:14:07.320 --> 00:14:09.559 and hardening the environment. Because these 00:14:09.559 --> 00:14:13.120 edge devices, routers, firewalls, load balancers, 00:14:13.139 --> 00:14:16.240 VPN gateways, they are the new front line of 00:14:16.240 --> 00:14:18.980 cyber warfare. A VPN gateway, for example, is 00:14:18.980 --> 00:14:21.259 literally designed to act as a door between the 00:14:21.259 --> 00:14:24.159 wild open internet and the secure internal network. 00:14:24.480 --> 00:14:27.179 It has to face outward to allow remote employees 00:14:27.179 --> 00:14:29.669 to log in. Kinsoft's main advice in the source 00:14:29.669 --> 00:14:32.090 material is incredibly adamant about this vulnerability. 00:14:32.450 --> 00:14:35.590 These edge devices must be patched obsessively. 00:14:35.789 --> 00:14:38.570 They require mandatory multi -factor authentication, 00:14:38.929 --> 00:14:42.570 or MFA. Yes, and critically, the management interfaces, 00:14:42.850 --> 00:14:45.429 the secret portals used by IT admins to actually 00:14:45.429 --> 00:14:47.970 configure the device settings, should never be 00:14:47.970 --> 00:14:50.169 exposed to the open internet. They should be 00:14:50.169 --> 00:14:53.059 hidden behind another layer of security. Here 00:14:53.059 --> 00:14:55.899 is where it gets really interesting. This wasn't 00:14:55.899 --> 00:14:58.899 a sophisticated, highly coordinated, Ocean's 00:14:58.899 --> 00:15:02.039 Eleven style heist. No. It was a boring, likely 00:15:02.039 --> 00:15:04.740 forgotten network management box just sitting 00:15:04.740 --> 00:15:07.860 out there on the internet that brought a 59 ,000 00:15:07.860 --> 00:15:10.860 person global giant to its knees. It's the digital 00:15:10.860 --> 00:15:13.240 equivalent of investing millions in vault doors 00:15:13.240 --> 00:15:16.419 and laser grids, but leaving the basement window 00:15:16.419 --> 00:15:19.029 unlocked. Exactly. Because attackers use automated 00:15:19.029 --> 00:15:21.769 tools to constantly scan the entire Internet 00:15:21.769 --> 00:15:25.110 24 -7, looking specifically for those unlocked 00:15:25.110 --> 00:15:27.429 basement windows. But the real triumph of Boston 00:15:27.429 --> 00:15:30.230 Scientific's response, the only reason this story 00:15:30.230 --> 00:15:33.210 doesn't end in a catastrophic regulatory nightmare 00:15:33.210 --> 00:15:35.870 regarding data privacy, comes down to something 00:15:35.870 --> 00:15:39.169 equally boring but incredibly vital. Which is 00:15:39.169 --> 00:15:42.759 logs. Network logs. Yes. CrowdStrike was only 00:15:42.759 --> 00:15:44.840 able to confidently announce that no data was 00:15:44.840 --> 00:15:47.840 taken because Boston Scientific had the meticulous, 00:15:47.919 --> 00:15:50.320 comprehensive network logs to mathematically 00:15:50.320 --> 00:15:53.360 prove it. OK, but how does a log actually prove 00:15:53.360 --> 00:15:54.960 a negative, though? How do you prove someone 00:15:54.960 --> 00:15:57.279 didn't take something? Think of a log like a 00:15:57.279 --> 00:16:00.120 highly advanced digital turnstile combined with 00:16:00.120 --> 00:16:02.600 a security camera. OK. It doesn't just record 00:16:02.600 --> 00:16:05.639 who enters a room. It records exactly how many 00:16:05.639 --> 00:16:08.340 bytes of data they interact with and, crucially, 00:16:08.460 --> 00:16:11.049 how many bytes of data flow back. out of the 00:16:11.049 --> 00:16:14.269 network. Right. A central logging system, often 00:16:14.269 --> 00:16:17.929 called a SIM, aggregates all this traffic. If 00:16:17.929 --> 00:16:20.149 the logs show an unauthorized IP address connected 00:16:20.149 --> 00:16:23.370 to a server, but the outgoing traffic log registers 00:16:23.370 --> 00:16:25.850 zero bytes of data transferred back to that external 00:16:25.850 --> 00:16:29.370 address, you have mathematical, forensic proof 00:16:29.370 --> 00:16:32.750 that no files were exfiltrated. Wow. And without 00:16:32.750 --> 00:16:35.409 that undeniable mathematical proof, it is a totally 00:16:35.409 --> 00:16:38.049 different reality. It is the legal difference 00:16:38.049 --> 00:16:40.429 between telling your customers nothing was taken 00:16:40.429 --> 00:16:43.529 versus we have no idea what they took. Right. 00:16:43.710 --> 00:16:46.610 Under strict regulatory frameworks like Australia's 00:16:46.610 --> 00:16:48.470 Privacy Act, mentioned in our source material, 00:16:48.730 --> 00:16:51.730 if a company cannot definitively prove that data 00:16:51.730 --> 00:16:54.070 wasn't taken during a breach, they are legally 00:16:54.070 --> 00:16:56.690 forced to assume the worst. They have to declare 00:16:56.690 --> 00:16:59.929 a notifiable data breach. That means alerting 00:16:59.929 --> 00:17:02.409 government regulators. Directly contacting 4 00:17:02.409 --> 00:17:05.680 .8 million patients. facing potentially massive 00:17:05.680 --> 00:17:09.099 financial fines. And suffering catastrophic long 00:17:09.099 --> 00:17:12.000 -term reputational damage. All because they lacked 00:17:12.000 --> 00:17:14.519 the data to prove a negative. Keeping those logs 00:17:14.519 --> 00:17:17.460 actively saved them from a regulatory apocalypse. 00:17:17.900 --> 00:17:20.099 It really did. It allowed leadership to stand 00:17:20.099 --> 00:17:23.000 up and say, with receipts, our patients are safe. 00:17:23.160 --> 00:17:25.740 Which perfectly sets up how they handled the 00:17:25.740 --> 00:17:28.220 public communication of this entire mess. Yeah, 00:17:28.240 --> 00:17:30.859 this case is actively being praised as a masterclass 00:17:30.859 --> 00:17:33.700 in crisis communication. It serves as a textbook 00:17:33.700 --> 00:17:36.640 model for how corporate transparency should function 00:17:36.640 --> 00:17:40.140 during an active crisis. It closely mirrors the 00:17:40.140 --> 00:17:43.339 continuous disclosure obligations that ASX -listed 00:17:43.339 --> 00:17:45.680 public companies are held to in Australia. Right, 00:17:45.740 --> 00:17:47.940 because usually companies try to sweep these 00:17:47.940 --> 00:17:50.519 incidents under the rug, or they wait until late 00:17:50.519 --> 00:17:52.900 on a Friday night to release a vague, jargon 00:17:52.900 --> 00:17:54.579 -filled statement hoping the news cycle just 00:17:54.579 --> 00:17:57.480 swallows it. But Boston Scientific played it 00:17:57.480 --> 00:18:00.569 entirely straight. First, They filed a voluntary 00:18:00.569 --> 00:18:04.049 disclosure with the SEC on day one. They didn't 00:18:04.049 --> 00:18:05.690 even know the full scale of the problem yet, 00:18:05.730 --> 00:18:07.529 but they immediately raised their hand and said, 00:18:07.589 --> 00:18:10.130 something is wrong, we are actively looking into 00:18:10.130 --> 00:18:12.569 it. From a leadership perspective, that is a 00:18:12.569 --> 00:18:15.309 difficult decision. The stock market fundamentally 00:18:15.309 --> 00:18:18.369 hates uncertainty, and admitting a breach before 00:18:18.369 --> 00:18:21.529 you have all the answers guarantees a short -term 00:18:21.529 --> 00:18:24.630 hit to your valuation. But they kept going. Step 00:18:24.630 --> 00:18:27.970 two, they provided regular, ongoing public updates. 00:18:28.430 --> 00:18:30.269 They didn't go dark for two weeks while the factory 00:18:30.269 --> 00:18:33.470 was down. Right. Step three, once the financial 00:18:33.470 --> 00:18:36.349 reality actually became clear, they filed the 00:18:36.349 --> 00:18:39.349 formal material incident SEC filing, admitting 00:18:39.349 --> 00:18:41.450 openly they were going to miss their financial 00:18:41.450 --> 00:18:44.630 guidance. And finally, step four, they published 00:18:44.630 --> 00:18:46.910 the actual forensic summary from CrowdStrike 00:18:46.910 --> 00:18:49.509 at the end, detailing exactly what the attackers 00:18:49.509 --> 00:18:51.549 touched and, more importantly, what they didn't. 00:18:51.710 --> 00:18:54.230 What stands out to you about how this was handled? 00:18:54.680 --> 00:18:57.240 Think about how you usually hear about corporate 00:18:57.240 --> 00:18:59.779 data breaches as a consumer. Yeah, it usually 00:18:59.779 --> 00:19:02.539 involves a leaked memo or an investigative journalist 00:19:02.539 --> 00:19:04.740 forcing the company to admit a failure months 00:19:04.740 --> 00:19:07.759 after the fact. Exactly. What stands out here 00:19:07.759 --> 00:19:10.220 is the realization that early honesty builds 00:19:10.220 --> 00:19:13.240 resilience and trust. Yes, the market punished 00:19:13.240 --> 00:19:16.039 their stock price in the short term. But by controlling 00:19:16.039 --> 00:19:18.460 the narrative with verified facts, rather than 00:19:18.460 --> 00:19:21.220 letting rumors and panic fill the void, they 00:19:21.220 --> 00:19:23.440 protected the long -term integrity of their brand. 00:19:23.920 --> 00:19:26.220 Patients and doctors still trust their medical 00:19:26.220 --> 00:19:28.980 devices because the company proved in real time 00:19:28.980 --> 00:19:31.660 that they prioritize transparency over saving 00:19:31.660 --> 00:19:34.319 face. It's the exact same dynamic as hearing 00:19:34.319 --> 00:19:37.519 bad news from a friend directly versus finding 00:19:37.519 --> 00:19:40.000 out they lied to you from a third party. Oh, 00:19:40.039 --> 00:19:42.119 absolutely. You can usually forgive the mistake, 00:19:42.299 --> 00:19:45.079 but the cover -up destroys the relationship permanently. 00:19:45.500 --> 00:19:48.019 And by publicly releasing the CrowdStrike forensic 00:19:48.019 --> 00:19:50.980 summary, they actively contributed to the collective 00:19:50.980 --> 00:19:53.299 defense of the entire medical device industry. 00:19:53.759 --> 00:19:55.980 Oh, that's a great point. Other massive enterprises 00:19:55.980 --> 00:19:58.480 can look at that specific report, identify that 00:19:58.480 --> 00:20:00.400 they use those exact same network management 00:20:00.400 --> 00:20:03.240 devices, and go secure their own perimeters before 00:20:03.240 --> 00:20:06.359 the attackers scan them next. Exactly. Well, 00:20:06.460 --> 00:20:08.599 we have covered a massive amount of ground today. 00:20:08.660 --> 00:20:10.779 We've gone from a global manufacturing shutdown 00:20:10.779 --> 00:20:13.920 to the intricate architecture of network logging 00:20:13.920 --> 00:20:17.539 and the psychology of corporate PR. So what does 00:20:17.539 --> 00:20:20.079 this all mean? Let's distill the core takeaways. 00:20:20.400 --> 00:20:23.279 Right. First, the edge of your network, those 00:20:23.279 --> 00:20:26.519 incredibly boring external routers and VPN gateways, 00:20:26.619 --> 00:20:28.940 they are your biggest liabilities. They are the 00:20:28.940 --> 00:20:32.160 unlocked basement windows. Second, you do not 00:20:32.160 --> 00:20:34.680 need a terrifying ransomware infection to suffer 00:20:34.680 --> 00:20:37.599 a catastrophic business outage. Your own defensive 00:20:37.599 --> 00:20:40.299 containment protocols can be just as paralyzing 00:20:40.299 --> 00:20:43.420 to your bottom line. And third, having exhaustive, 00:20:43.420 --> 00:20:46.720 unalterable network logs is your absolute only 00:20:46.720 --> 00:20:49.420 defense against regulatory nightmares. Logs are 00:20:49.420 --> 00:20:51.400 the only mechanism you have to mathematically 00:20:51.400 --> 00:20:54.420 prove a negative and save your company's reputation. 00:20:54.960 --> 00:20:57.960 It demands that we completely redefine what readiness 00:20:57.960 --> 00:21:01.059 actually means for a modern enterprise. It really 00:21:01.059 --> 00:21:03.779 does. And that brings us to our call to action 00:21:03.779 --> 00:21:06.339 for you listening right now. Think about your 00:21:06.339 --> 00:21:08.500 own workplace, your own company, or even your 00:21:08.500 --> 00:21:10.890 personal home network setup. Do you know what 00:21:10.890 --> 00:21:12.930 single point of failure would grind your entire 00:21:12.930 --> 00:21:15.930 day to a halt if you had to physically pull the 00:21:15.930 --> 00:21:18.390 plug to stop an intruder? What is the one core 00:21:18.390 --> 00:21:21.109 system you genuinely cannot run without? And 00:21:21.109 --> 00:21:23.150 is it sitting dangerously close to an exposed 00:21:23.150 --> 00:21:26.029 edge device? It is a map worth drawing today 00:21:26.029 --> 00:21:29.849 before the alarms actually go off. And as you 00:21:29.849 --> 00:21:33.849 map that out, consider this final thought. We 00:21:33.849 --> 00:21:35.789 started today talking about the bank manager 00:21:35.789 --> 00:21:38.609 who locks the doors to protect an untouched vault. 00:21:39.690 --> 00:21:41.730 effectively bankrupting the business in the process. 00:21:42.369 --> 00:21:45.369 As cyber threats become increasingly ambiguous 00:21:45.369 --> 00:21:48.529 and our automated defensive containment protocols 00:21:48.529 --> 00:21:52.130 become more aggressive to match, we have to wonder, 00:21:52.190 --> 00:21:55.130 will the most destructive, expensive cyber incidents 00:21:55.130 --> 00:21:57.349 of the future actually be caused by attackers 00:21:57.349 --> 00:22:01.210 at all? Or will they be caused by companies being 00:22:01.210 --> 00:22:03.450 forced to completely paralyze their own operations 00:22:03.450 --> 00:22:05.890 just to prove to the regulators that they are 00:22:05.890 --> 00:22:09.160 safe? Now that is a thought to keep you up at 00:22:09.160 --> 00:22:12.099 night. The shield becoming heavier and more dangerous 00:22:12.099 --> 00:22:14.660 than the sword. Thank you for joining us on this 00:22:14.660 --> 00:22:16.819 deep dive into the modern mechanics of cyber 00:22:16.819 --> 00:22:19.500 warfare and corporate resilience. Keep questioning, 00:22:19.640 --> 00:22:21.819 keep learning, and we will catch you next time.