In late 2023, APRA imposed extra licensing conditions on NGS Super following a cyberattack earlier that year which resulted in data loss and compromised systems. This action reflected APRA's growing emphasis on enhancing cyber controls within superannuation funds. Despite previous directives encouraging proactive cybersecurity strategies, recent attacks suggest that not all funds have adequately fortified their defenses.
The method employed in recent attacks, primarily 'credential stuffing', leverages stolen username and password pairs gained from prior data breaches. Insignia Financial disclosed that such an attack facilitated unauthorised access to its MLC Expand platform, compromising user accounts due to the frequent reuse of credentials across services.
Despite comprehensive cybersecurity measures, AustralianSuper recently revealed that its members suffered direct financial losses amounting to $500,000. This underscores the financial repercussions of cyber threats on individual investors and the need for enhanced vigilance.
Cybersecurity experts emphasize the importance of a cooperative industry response to these threats. Louis Droguett, CEO of Software@Scale, explained that the real issue lies in the exploitation of leaked credentials rather than failures in firewall protection or multi-factor authentication (MFA). He advocates for proactive dark web monitoring to identify compromised member information swiftly and mitigate potential exploits before damage occurs.
As the frequency and sophistication of cyber threats increase, the necessity for robust cybersecurity frameworks within Australia's superannuation sector becomes increasingly urgent.
Looking forward, the financial sector should anticipate more stringent regulatory measures from APRA, aiming to compel super funds to upgrade their cyber defenses. Moreover, there is a pressing call for industry-wide collaboration to share intelligence and strengthen the collective security posture against evolving cyber threats.
