The gap between expectation and reality

As we all know by now, in April a group of cybercriminals attempted to gain access to many Australians' superannuation fund accounts. Using data they'd found on the dark web, including usernames and passwords, they attempted to withdraw their retirement savings.

- By Jamie Williamson

While most were thwarted in one way or another, some were successful; AustralianSuper admitted to having to reimburse some members to the collective tune of about $700,000.

You'll recall that at the time, all funds said they were in contact with regulators and the Office of the Australian Information Commissioner. And while they were adamant their system controls were robust, speculation which then all but became fact - was rife that it was due to a lack of multi-factor authentication (MFA) protections; perhaps the most basic and common information security guardrail there is.

The 'credential stuffing' attacks began on April 4, with some funds seeing attempts continue in the days that followed.