When a breach hits a super fund or a bank, the damage isn't just financial — it's the end of trust

Why the financial services sector is targeted:

Financial services organisations hold a uniquely attractive combination of assets. Customer financial data can be monetised directly through account takeover and fraud. Personally identifiable information — names, dates of birth, tax file numbers, bank account details — commands premium prices on criminal marketplaces and enables follow-on identity fraud at scale. Payment systems and settlement infrastructure offer direct access to funds. And for state-sponsored actors, intelligence on capital flows, investment positions and institutional financial health carries strategic value entirely separate from financial gain.

The sector’s complexity compounds these risks. A mid-tier bank or super fund may depend on dozens of third-party technology and service providers — core banking platforms, payment processors, identity verification services, cloud hosting providers, managed security vendors — each of which represents a potential entry point. APRA’s introduction of CPS 230 in 2025, with its explicit requirements around third-party and material service provider risk, reflects regulators’ growing recognition that the supply chain is now as important as the perimeter.

The April 2025 super fund attacks — and what they revealed:

In late March and early April 2025, a coordinated series of credential stuffing attacks struck multiple major Australian superannuation funds in rapid succession. AustralianSuper, Rest, Insignia Financial, Hostplus and Australian Retirement Trust all reported suspicious activity, with approximately 600 AustralianSuper member accounts compromised and AU$500,000 stolen from four accounts. Rest’s CEO shut down the member portal immediately and launched incident response protocols. APRA and ACSC intervened directly, contacting fund boards about authentication control expectations.

The attacks were notable not for their technical sophistication, but for their effectiveness against known, addressable weaknesses. Attackers used stolen credentials from unrelated prior breaches, purchased from criminal marketplaces, to test access against super fund portals using automated bots — a technique that would have been blocked by mandatory multi-factor authentication. The incidents reinforced a pattern visible across the OAIC’s breach data: the finance sector continues to report high volumes of breaches attributable to compromised credentials and phishing, not novel zero-day exploits. Most preventable breaches succeed because exposure has not been closed.

The structural technology challenge:

Financial services IT infrastructure is characterised by complexity, legacy burden and a continuous modernisation tension. Major banks and insurers maintain core systems built across decades, with integration layers, middleware and cloud migrations layered on top. Superannuation funds have undergone rapid digital uplift to meet member expectations for self-service account management — often outpacing the security architecture designed to protect those new digital channels. Regional banks, customer-owned banks and insurers frequently operate with lean technology teams responsible simultaneously for daily operations, compliance uplift, cloud migration and incident response.

Branch network infrastructure introduces additional exposure. Payment terminals, ATMs, access control systems and customer-facing digital kiosks are increasingly networked into corporate infrastructure — creating convergence points that blur traditional security perimeters. A compromise of branch network infrastructure is no longer just an operational disruption; it is a potential entry point into broader payment and data systems.

The pace of digital banking adoption has accelerated these pressures. Customers now expect real-time payments, 24/7 mobile banking and seamless omnichannel service. Outages are newsworthy. A payments failure or prolonged application downtime carries immediate reputational and regulatory consequences — which creates pressure on operations teams to prioritise availability, sometimes at the cost of the security architecture upgrades that would reduce exposure.

Third-party and supply-chain risk:

APRA’s CPS 230 framework reflects the reality that financial institutions’ operational resilience is only as strong as their material service providers’. Core banking platform vendors, cloud hyperscalers, managed security providers, payment processors and software-as-a-service platforms each represent a risk concentration point. An institution may have excellent internal controls and still suffer a significant incident via a compromised vendor. The requirement under CPS 230 to maintain and submit a material service provider register to APRA, assess downstream provider risks, and demonstrate that critical operations can continue through vendor disruption has elevated third-party risk from a compliance checkbox to a sustained operational discipline.