What happened
In December 2019 (around 12 December) P&N Bank suffered a breach at a third-party hosting provider during a CRM upgrade, exposing customers’ names, contact details, age, customer and account numbers, and account balances [pnb-bleeping], [pnb-itnews]. Media reported about 100,000 customers were affected [pnb-bleeping]. The bank said its core banking system (passwords, card details) was isolated from the affected CRM, and that the CRM did not hold driver licence, passport or tax file numbers, or dates of birth [pnb-itnews], [pnb-ff].
Current status
Disclosed. WA Police and federal authorities were engaged [pnb-bleeping]. The ~100,000 figure is as reported by media (attributed to The West Australian); the bank emailed about 96,000 members and did not publish a confirmed count of affected customers [pnb-itnews], [pnb-ff].
Why it matters
Account balances plus contact details are a potent combination for targeted scams, and the incident again turns on a third-party system rather than the bank’s core platform.