👉 Background: Australia’s superannuation industry is one of the largest pension fund programs in the world. In fact, it's worth more than $4.2 trillion and has grown by nearly $800 billion in just the last 4 years.

👉 What happened: Late last week, some of Australia's largest super funds, AustralianSuper, Australian Retirement Trust, Hostplus, Rest and Insignia suffered a co-ordinated cyberattack — all at the same time. The attack targeted retiree super fund customers who can legally take money out of their accounts.

👉 What else: More than 9,000 accounts had been breached through 'credential stuffing', with AustralianSuper being the only fund to report that money was stolen. Four super fund members lost around $500,000. But now, APRA, the financial institution watchdog, has warned all super funds to come forward ASAP… ooorrr else.

‍

‍What's the key learning?

‍

‍💡Cybersecurity isn't just about tech—it’s a major trust issue. Super funds are meant to be the cornerstone of Australian retirement, so any sign of weakness can rattle millions of members. Currently, 73% of Australians trust their super funds over the Government, but when their money is compromised, the trust levels can plummet fast.‍

‍💡 Typically we think of cyberattacks as targeting big banks or major tech firms, but super funds are prime targets because:

1. They have huge pools of money
2. They hold valuable personal data
3. Many of them have an older demographic that might not have the digital know-how to navigate a cyberattack

💡Interestingly, APRA did an audit on the major super funds two years ago and found “foundational issues” with their cybersecurity. So, it seems like it was only a matter of time until these gaps were exploited.