What happened
In early 2025 several Australian superannuation funds — including AustralianSuper, Rest, Hostplus, ART and Insignia — were hit by a coordinated credential-stuffing campaign, in which attackers used stolen passwords to access member accounts [sbs-super], [cyberdaily-super]. Rest said about 8,000 members may have had personal information accessed, with about 20,000 accounts affected; AustralianSuper said up to 600 members’ passwords were used; Insignia reported about 100 accounts and ART “several hundreds” [sbs-super]. SBS News reported it understands four AustralianSuper members lost a combined ~A$500,000; the fund has not confirmed this figure [sbs-super]. No aggregate number of members affected was officially published, and none is estimated here.
Timeline
- 2025-03-29/30 — Rest detected unauthorised activity over the weekend [cyberdaily-super].
- 2025-04-04 — Attacks on multiple funds reported publicly [cyberdaily-super], [sbs-super].
- 2025-04-08 — National Cyber Security Coordinator warned of scams; APRA and ASIC reported to be engaging with funds [cyberdaily-super-ncsc].
Current status
Disclosed. APRA and ASIC were reported to be engaging with the funds, and the National Cyber Security Coordinator was coordinating the response [cyberdaily-super-ncsc]. No regulator enforcement action on this incident has been reported. Figures are as reported.
Why it matters
A reminder that reused passwords — not a fund’s own systems — can expose retirement savings, and that one campaign can hit an entire sector at once.