Major Australian Super Funds Hacked: Credential Stuffing Attack Exposes Security Gaps

In late March 2025, several major Australian superannuation funds fell victim to coordinated cyberattacks, leading to unauthorized access of member accounts and significant financial losses. Funds affected include AustralianSuper, Australian Retirement Trust (ART), Rest Super, Insignia Financial, and Hostplus. AustralianSuper reported that approximately 600 member accounts were compromised, resulting in the theft of around $500,000 from four accounts.

The attackers employed a technique known as “credential stuffing,” utilizing previously stolen usernames and passwords to gain unauthorized access to accounts. This method exploits the common practice of reusing passwords across multiple platforms. The absence of multifactor authentication (MFA) in some funds, notably AustralianSuper, exacerbated vulnerabilities, despite prior warnings from regulators to implement such security measures.

In response to the breaches, AustralianSuper announced plans to expedite the rollout of MFA across its services within a month, significantly accelerating the previously planned 18-month timeline. Other affected funds have also initiated investigations and enhanced security protocols to prevent future incidents. ​

Government agencies, including the Australian Federal Police and the Office of the Australian Information Commissioner, are involved in ongoing investigations. The incidents have prompted calls for stricter cybersecurity regulations within the superannuation industry to safeguard members’ retirement savings against evolving cyber threats. ​

This event underscores the critical need for robust cybersecurity measures in protecting sensitive financial information and highlights the importance of proactive security practices to mitigate the risk of cyberattacks.