Multiple local super funds hit by coordinated cyberattack

Multiple large superannuation funds have been hit by a coordinated cyberattack that has led to members losing money after their accounts were accessed by the criminal enterprise.

Industry super funds Australian Retirement Trust, AustralianSuper, Hostplus, Rest and the largest retail superannuation brand owner Insignia have all been subject to the attack, according to multiple sources aware of the investigation who spoke on the condition of anonymity. The hackers were able to access superfund passwords, most likely on the dark web, according to the sources.

The funds have all been working with the National Cyber Security Coordinator to assess the depth and the breadth of the problem, given there are fears more customers at those funds — and at other funds – had also been affected by the hack.

The hackers appear to have familiarity with the Australian superannuation system, targeting people in pension drawn down phase who are able to request lump sum withdrawals. The attacks mostly took place in early hours of the morning so that customers did not see the password change alerts on their phones.

AustralianSuper Chief Member Officer Rose Kerlin urged members to check their accounts and to contact the fund if they noticed their password had been changed.

“Over the past week, we have seen a spike in suspicious activity across our member portal and mobile app and we
are urging members to take steps to protect themselves online,” Kerlin said.

“This week we identified that cyber criminals may have used up to 600 members’ passwords to log into their
accounts in attempts to commit fraud.”

“While we took immediate action to lock these accounts and let those members know, there are things members
can do right now to protect themselves online,” she added.

The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.