Speaking at Momentum Media’s Election 2025 breakfast event in Sydney, chief executive of the Association of Superannuation Funds of Australia (ASFA), Mary Delahunty, took a moment to address the cyber incident that gripped some Australian super funds last week.
Initially, the funds affected by the incident included Rest, Hostplus, AustralianSuper, Insignia’s Expand platform, and Australian Retirement Trust, followed later by Cbus Super and Media Super, which raised alarms after a surge of suspicious login attempts.
“I’m sure all of you are aware of the cyber incident that affected several superannuation funds recently. It’s now being investigated by police and government authorities,” Delahunty said to attendees on Thursday morning.
“While I can’t say a lot at the moment, I can say that the cyber criminals undertook a coordinated, well-funded and sophisticated attack on our system.”
Expounding on how this was done, the CEO said that the hackers attempted to access the retirement funds of Australians using stolen or approximated email addresses and passwords to log in – a process known as credential stuffing.
“The superannuation sector is taking this extremely seriously, as we should,” Delahunty said.
“Australians place enormous trust in the super system, and rightly expect that their retirement savings will be safe and protected. And when that trust is tested, it must be taken seriously. The funds involved and the broader ASFA member base, which includes those critical service providers, are doing exactly that.”
According to her, reviews are currently underway to assess where further protections are needed, adding that the Australian Prudential Regulation Authority (APRA) continues to be a strong and consistent regulator in this area.
“They have managed an enormous and rapid uplift of capability across the whole financial sector. And make no mistake, it is a challenge for all financial services to stay ahead of increasingly sophisticated cyber criminals, but we are determined to do it.”
ASFA will continue to hold this area of work as a key priority, its CEO promised, not only due to the recent incident, but because cyber resilience is “core” to the sustainability of the sector.
“So as we head into this election cycle, that work underscores a broader challenge – making sure the policy settings we advocate for protect the safety of Australia’s retirement savings, sustain long-term trust in the system, and support a superannuation framework that is not only equitable and effective, but resilient for the future,” Delahunty underscored.
Earlier this week, Treasurer Jim Chalmers said both APRA and ASIC are engaging with all of the potential impacted super funds to support safe outcomes for members.
“On Friday, we convened the council of financial regulator agencies to get an update on their ongoing response to this incident as well. That’s working around the clock in response to the incident, and it’s all about protecting fund members and improving security measures,” the Treasurer said.
