AustralianSuper, Hostplus Among Multiple Super Funds Hacked in Major Cyberattack

Members are urged to change their passwords and look for any suspicious activity on their accounts.

File photo of a hacker on his computer. Nicolas Asfouri/AFP via Getty Images

Hackers have targeted hundreds of Australian superannuation accounts in what appears to be a coordinated attack.

Several super funds were reported to have been affected, including AustralianSuper, Australian Retirement Trust, Hostplus, and Rest.

According to the Association of Superannuation Funds of Australia (ASFA), the hacking incident occurred last weekend.

Story continues below advertisement

While most of the attack attempts were repelled by super funds’ cyber defence, hackers managed to break into the accounts of some members, resulting in financial losses.

“Funds are contacting all affected members to let them know and are helping any whose data has been compromised,” the ASFA said.

Meanwhile, AustralianSuper Chief Member Officer Rose Kerlin said there was a surge in suspicious activity across the super fund’s member portal and mobile app in the past week.

“This week, we identified that cybercriminals may have used up to 600 members’ stolen passwords to log into their accounts in attempts to commit fraud,” she said.

“While we took immediate action to lock these accounts and let those members know, there are things members can do right now to protect themselves online.”

Story continues below advertisement

Kerlin also urged members to log into their accounts to check if their bank accounts and contact details are correct, and advised them to use strong and unique passwords to protect themselves from hackers.

“We are highlighting this event to make sure members are alert and take all possible precautions to protect their retirement savings,” she said.

Government’s Response

National Cyber Security Coordinator Lieutenant General Michelle McGuinness said she was aware of the attack and that government agencies were coordinating a response.

“I am working with agencies across the Australian government including with the financial system regulators, and with industry stakeholders to provide cyber security advice and coordinate the whole-of-government response to this incident,” she said on social media.

“The Australian Prudential Regulation Authority (APRA) and Australian Securities and Investments Commission (ASIC) are engaging with all potentially impacted superannuation funds to support safe outcomes for members.

Story continues below advertisement

“We are continuing to work with affected superannuation funds in response to this issue.”

McGuinness urged Australians to follow the advice of their super funds, engage with them if there is a problem, as well as remain vigilant of potential fraud.

“If you are concerned about potential impacts from this, the Australian Government’s trusted source of cyber security advice–http://cyber.gov.au–has information on simple steps you can take to protect yourself online,” she said.

Australian Super Funds Have Rigorous Cyber Protection: ASFA

Meanwhile, the ASFA assured Australians that superannuation funds and their service providers have already implemented “rigorous cyber protections.”

The peak body also noted that it had developed a measure to help improve the sector’s cyber security.

Story continues below advertisement

“In a rapidly evolving threat landscape, there will always be new and emerging risks, but Australia’s super sector is proactively working together to improve system-wide defences, including through the ASFA Financial Crime Protection Initiative (FCPI),” it said.

“Through the FCPI, [the] ASFA will imminently be releasing a toolkit to ensure strong sector coordination in relation to cyber security.”

The hacking incident comes as recent data indicated that there was a 23 percent rise in cybercrime cases in 2024, with a cyberattack occurring every six minutes.