Reading time: 3 mins
Australian governments and industry are currently being targeted by major cyber-attacks that could put pressure on critical infrastructure and public services. The threat has become so acute that Prime Minister Scott Morrison held a press conference last Friday to warn of this increasingly hostile trend, likely to be the work of a nation state1.
We recently wrote a note on the unscrupulous ways cyber criminals are exploiting the coronavirus crisis for financial gain. In addition, Chinese-sponsored hackers are attempting to steal intellectual property related to the development of coronavirus treatments and vaccines, according to the FBI and Department of Homeland Security2. There has also been a recent increase in Australian corporates targeted by hackers demanding ransoms or stealing data to be sold on the ‘dark web’. Here are some examples:
Beer and dairy giant Lion
The company behind beer brands XXXX, Tooheys, Little Creatures and James Squire has been hit with two ransomware attacks in June 2020 that have severely disrupted production and distribution. Lion are hoping to get some of their breweries up and running soon, but their dairy businesses (Pura and Dairy Farmer) also faces supply chain issues and the challenge of product perishability.
Figure 1: A screenshot of the hacker’s ransom demand put to Lion, as reported by IT Wire3
The global freight and logistics company had data stolen which was subsequently published on the dark web. Employee information including name, address, age, salary, superannuation and tax file numbers were accessed by the hackers. Toll discovered the breach in January 2020 and were forced to bring down customer facing systems and portals, with customer access and functionality affected through to the end of May4.
Australian tech unicorn Canva
The graphic design software disrupter was itself disrupted by a hacker with the alias ‘GnosticPlayer’, who stole 139 million customers’ personal data, including names, email addresses, locations and some password data5.
In one of the more well-known Australian hacks, the outdoor clothing retailer’s online store was breached in 2019 with online customers details stolen, including name, contact, address details, credit card details and usernames and passwords6.
Government and corporate spending in response to this challenge
Increased government and private sector spending on cyber security is a global phenomenon. Australia may have been a laggard in this area, but that is changing.
The Australian Signals Directorate, which operates the Australian Cyber Security Centre, was spun out from the Department of Defence in July 2018 to become a standalone agency with $3.3 billion of funding, in recognition of the increasing importance of cyber security7. In addition, the Federal Government is due to release a new cyber security strategy any day now, which is likely to increase funding for this area8.
In 2018, the total external spending on cyber security in Australia reached US$2.7 billion, part of a global total of US$109 billion9. Corporate Australia’s awareness of the requirement to invest in cyber security is growing due to the attacks experienced by Lion, Toll Group and others, and well as new cyber reporting regulations. A recent Telstra survey showed that 84% of Australian companies are planning to increase their overall security spending over the next 12 to 24 months, with only 2% expecting to decrease their security budgets10.
Cyber security: How to get investment exposure
The global cyber security market is currently worth around $US173 billion and is forecast to grow by 56% to US$270 billion by 202611.
ASX-listed stocks offer little, if any, exposure to this expected increase in spending. However, investors looking to gain exposure to the companies best-positioned to benefit from long-term structural growth and capitalise on the current tailwinds can consider an ETF such as the BetaShares Global Cybersecurity ETF (ASX: HACK).
HACK currently holds 43 of the leading global cyber security companies from around the world including Crowdstrike and Cisco, who are at the forefront of the fight against cybercrime. HACK has returned 20% p.a. from inception12 to 29 May 2020, and over the last year has outperformed the broad global shares benchmark (MSCI World (AUD)) by 16.3%13.
1. Crowe, David. “Morrison reveals malicious ‘state-based’ cyber attack on governments, industry” The Age, 19 June 2020, https://www.theage.com.au/politics/federal/morrison-reveals-malicious-state-based-cyber-attack-hitting-several-sectors-20200619-p5545z.html
2. Lipson, David. “US claims China stealing coronavirus vaccine info fit with Donald Trump’s re-election plan” ABC News, 15 May 2020, https://www.abc.net.au/news/2020-05-15/us-claims-of-china-coronavirus-hack-fit-with-trump-plan/12248354
3. Varghese, Sam. “Attackers give Lion deadline for paying ransom of US$800,000” IT Wire, 17 June 2020, https://www.itwire.com/security/attackers-give-lion-deadline-for-paying-ransom-of-us%24800,000.html
4. “Toll IT Systems Updates”, Toll Group, 29 May 2020, https://www.tollgroup.com/toll-it-systems-updates
5. Cimpanu, Catalin. “Australian Tech Unicorn Canva Suffers Security Breach.” ZDNet, 24 May 2019, https://www.zdnet.com/article/australian-tech-unicorn-canva-suffers-security-breach/
6. “Kathmandu customer data breach”, StaySmartOnline, 15 March 2019, https://www.staysmartonline.gov.au/alert-service/kathmandu-customer-data-breach
7. “Defence budget overview”, Parliament of Australia, Accessed 22 June 2019, https://www.aph.gov.au/About_Parliament/Parliamentary_Departments/Parliamentary_Library/pubs/rp/BudgetReview201819/DefenceB
8. “Australia’s 2020 Cyber Security Strategy Discussion Paper”, Department of Home Affairs, September 2019, https://www.homeaffairs.gov.au/reports-and-pubs/files/cyber-security-strategy-2020-discussion-paper.pdf
9. “Australia’s Cyber Security Sector Competitiveness Plan 2019 Update” AustCyber, 19 December 2019, www.austcyber.com/resource/australias-cyber-security-sector-competitiveness-plan-2019
10. “Telstra Security Report”, Telstra, Accessed 22 June 2019, https://www.telstra.com.au/business-enterprise/news-research/security/research/security-report-2019
11. “Australia’s Cyber Security Sector Competitiveness Plan 2019 Update” AustCyber, 19 December 2019, www.austcyber.com/resource/australias-cyber-security-sector-competitiveness-plan-2019
12. Inception date of HACK is 30 August 2016.
13. As at 29 May 2020. Past performance is not indicative of future performance.