In early April, coordinated cyberattacks struck several of Australia’s largest superannuation funds.
The attackers used personal information to gain unauthorised access to member accounts, resulting in significant financial and reputational impact. AustralianSuper reported $500,000 in losses across just four compromised accounts.
While the scale of these attacks is alarming, they also provide a clear opportunity: to strengthen resilience, modernise readiness practices, and build greater trust with members.
What happened, why it matters, and what can super funds – and should – be doing next?
What We Know About the Attacks
According to media reports, the attackers leveraged stolen personal data to reset account credentials and access member funds. Key vulnerabilities included:
-
Inconsistent use of multifactor authentication (MFA)
-
Weak identity verification during password resets and withdrawals
-
Gaps in response planning and communications workflows
Notably, these attacks came just months after ASIC warned superannuation trustees of rising cyber risks, especially for members close to retirement, who often have large, liquid balances.
The incident is part of a broader trend: financial services are facing increasingly coordinated, intelligent, and fast-moving threats, often exploiting not just technical gaps, but human and procedural weaknesses.
Why Superannuation Funds Are High-Value Targets
Super funds sit at a unique intersection of value and vulnerability. They manage:
-
Billions in member savings
-
High volumes of sensitive personal information
-
Digital-first services with wide public access
-
Operational complexity involving internal teams and third-party providers
This makes them a compelling target, not only for one-off attackers, but for organised cybercriminal groups looking for large payouts with relatively low resistance.
What This Means Going Forward
The cyberattacks on Australian super funds mark a pivotal moment to modernise readiness, not only to prevent future breaches, but to respond swiftly and confidently when they happen.
Key takeaways:
-
Cyber resilience is not just IT’s job – it spans communications, compliance, customer service, and executive teams
-
Readiness is a team endeavor – success depends on practiced response, not just documentation
-
Trust is built in moments of truth – your members will remember how quickly and clearly you respond
5 Steps Funds Should Be Taking Right Now
To strengthen readiness and prevent future incidents, here are five focused actions that every super fund can prioritise:
1. Mandate Multifactor Authentication (MFA)
If MFA isn’t turned on for all member and staff logins, now is the time. It’s a low-lift, high-impact step to protect against credential-based attacks.
2. Tighten Identity Verification
Implement layered verification for sensitive actions. That might include knowledge-based authentication, biometric checks, or time-based alerts for unusual behavior.
3. Run Cyber Simulations Often
Don’t wait for the next breach to test your readiness. Practice real-world cyber scenarios across all key functions, including IT, comms, legal, and customer support.
Simulations don’t need to be long or complex. Even 15-minute “micro-drills” can expose blind spots and build confidence.
4. Invest in Real-Time Monitoring
Cybercriminals move fast. Early detection is essential. Use behavioral analytics and AI-driven tools to flag anomalies like bulk login attempts, rapid withdrawals, or unrecognised device activity.
5. Be Communication-Ready
Build clear, pre-approved messages for members, regulators, and media. Create templates for various cyber scenarios so you’re never starting from scratch under pressure.
How iluminr Supports Practical Resilience
iluminr helps organisations move beyond static plans, PDF procedures, and tick-box compliance toward something far more powerful: living, breathing readiness that scales with the pace of modern risk.
Where traditional approaches often fall short during real-world pressure, iluminr builds muscle memory, cross-functional coordination, and confidence through consistent, purposeful practice.
Cyber Microsimulations
Instead of waiting for an annual tabletop, iluminr delivers bite-sized, real-world cyber scenarios that teams can run anytime — without derailing the workday.
-
Practice responses to phishing, ransomware, credential theft, data breaches, and more
-
Engage cross-functional teams (IT, comms, legal, execs) in realistic role-based exercises
-
Identify blind spots before attackers do — from password reset processes to customer notifications
Microsimulations are short, practical, and scalable, helping teams build readiness over time, not just check a box once a year.
Dynamic Playbooks
When something goes wrong, the worst thing a team can do is reach for a static plan.
iluminr replaces traditional response documents with dynamic, digital playbooks that adjust based on the scenario, stakeholder, and severity.
-
Guide users through real-time steps in plain language
-
Integrate decision logic and escalation paths directly into the workflow
-
Keep everyone aligned, from frontline support to boardroom leadership
Playbooks help organisations respond faster, reduce errors, and stay compliant even when the pressure is high and time is short.
Mass Communications
Speed and clarity matter in a crisis, especially when members and regulators are watching.
iluminr’s mass communications tools allow teams to reach the right people with the right message at the right time, across:
-
SMS
-
Email
-
Voice
-
In-app or browser-based alerts
Whether it’s notifying members of suspicious activity, updating executives on incident status, or coordinating with vendors, iluminr ensures no one is left in the dark.
All messages are logged, trackable, and auditable — giving teams the assurance that they’re communicating clearly and compliantly under pressure.
Board and Executive Insights
Executives and boards need more than vague readiness scores. iluminr’s dashboards give them:
-
Real-time visibility into team performance, response status, and open risks
-
Metrics from Microsimulation participation to time-to-escalation
-
The ability to drill down by business unit, risk type, or scenario
It turns resilience from a mystery into a measurable business asset — enabling better decisions, better governance, and greater confidence in your ability to respond.
A Moment to Build
Together, these capabilities help illuminate your path forward, making resilience a daily practice, not a dusty document.
Whether you’re responding to cyber threats, navigating regulatory risk, or communicating under pressure, iluminr helps your team be ready…and stay ready.
Let’s talk about how we can help your organisation close the gap between planning and performance.
