April 4th, 2025

Australian pension funds have been targeted by a significant wave of credential stuffing attacks, This occurred over the weekend of March 29-30, 2025, and affected multiple large Australian super funds, potentially compromising thousands of members' accounts. The Association of Superannuation Funds of Australia (ASFA) acknowledged that some members were affected, although most attempts were repelled. Reuters reported that over 20,000 accounts were breached, with some members reportedly losing savings. Several major funds, including AustralianSuper, Hostplus, REST, Australian Retirement Trust, and Insignia Financial, confirmed that some of their members' accounts were breached. AustralianSuper reported at least 600 breached accounts, while REST disclosed that around 8,000 members had limited personal information accessed. Insignia Financial stated that approximately 100 accounts on its Expand Platform were compromised. ASFA has established a hotline and released a toolkit to enhance coordination within the superannuation industry in response to such financial crimes.