Speaker 1: From The Australian. Here's what's on the front. I'm Claire Harvey.
Speaker 1: It's Wednesday, April nineth, twenty twenty five, and for now
Speaker 1: Benezi and Peter Dutton have faced off in the first
Speaker 1: debate of this election campaign, a clash that inevitably turned fiery.
Speaker 2: In the twenty fourteen budget, thirty b and dollars was
Speaker 2: repped out of public schools. In that budget, fifty b
Speaker 2: and dollars was repped out of hospitals. That is not
Speaker 2: the factually correct statement. It's misleading, it's designed to scare people,
Speaker 2: and I think it's dishonest from a man who wants
Speaker 2: to be re elected as the Prime minister of our country.
Speaker 2: In forty years, there has not been a higher spending
Speaker 2: government than your government. Is that correct?
Speaker 3: Well, that's not true, except for the one that you
Speaker 3: were a part of.
Speaker 1: The Greens are pitching their campaign at Australia's seven million renters,
Speaker 1: with leader Adam Bandt at the Press Club on Wednesday
Speaker 1: to demand capital gains, tax breaks and negative gearing be
Speaker 1: axed and a freeze on rent increases. All the latest
Speaker 1: from the campaign and our experts analysis is live now
Speaker 1: at the Australian dot com dot au. Australian super has
Speaker 1: finally called in the police to investigate a hack that
Speaker 1: saw four hundred and six thousand dollars drained from an
Speaker 1: elderly customer's superannuation account. But the scandal has revealed huge
Speaker 1: holes in superfund's ability to keep our money away from criminals,
Speaker 1: or even to allow us to log into their websites
Speaker 1: to find out how much money we have left today?
Speaker 1: Is our money safe in super? Towards the end of March,
Speaker 1: a seventy four year old Queensland woman received some correspondence
Speaker 1: from her superannuation fund. We'll call her Joan. Australian super
Speaker 1: was writing to Joan, it said, to confirm withdrawals made
Speaker 1: from her account a week earlier. That's odd, Joan hadn't
Speaker 1: made any withdrawals, much less for one hundred thousand dollars
Speaker 1: at a time, and it wasn't just one. Joan realized
Speaker 1: with increasing horror that six withdrawals totaling four hundred and
Speaker 1: six thousand dollars had been made from her super over
Speaker 1: the space of a week. When she alerted the superfund
Speaker 1: to the fraud, she expected a swift response, but for
Speaker 1: ten agonizing days. It was crickets. The fund failed to
Speaker 1: raise the incident with the Commonwealth Bank and didn't commit
Speaker 1: to covering the loss until The Australian's Business reporter Cleoner
Speaker 1: O'Dowd started asking questions almost three weeks after the attack began.
Speaker 1: And Joan's not the only one caught up in this mess.
Speaker 4: Several Australian superannuation funds have been targeted by cyber criminals.
Speaker 4: It's caused panic and frustration for thousands of members who've
Speaker 4: been unable to check whether their nest egg has been impacted.
Speaker 1: Jared Lynch is The Australian's Technology editor. The story of
Speaker 1: Joan and her loss of four hundred and six thousand
Speaker 1: dollars from her superfund is just staggering. And what does
Speaker 1: that tell us about the safety of all of our funds.
Speaker 3: It tells us that our safety is expendable and can
Speaker 3: be cracked within seconds by anyone who's got the will
Speaker 3: to be able to do that. How they've been able
Speaker 3: to get in the hackers is that they've got a
Speaker 3: heap of people's usernames. They've ever tried to get a
Speaker 3: heap of passwords from the dark web, from previous breaches
Speaker 3: or they have done what's called a brute force attack,
Speaker 3: which is to keep guessing, scrambling, guessing until you're getting
Speaker 3: through the door. And because there's no multi factor of
Speaker 3: authentication which means you get a notification on your phone
Speaker 3: or through a third party app to verify yourself, that
Speaker 3: means that they can walk straight in through the door
Speaker 3: and do what they like with your account.
Speaker 1: How big is this jared compared to other hacks that
Speaker 1: we've seen of major companies like, for example, OPTAs.
Speaker 3: Australia super would love to compare it to OPTAs, saying
Speaker 3: that well, they had the data of nine and a
Speaker 3: half million Australian stolen. We've only had a very small
Speaker 3: problem here and that of course has been the problem
Speaker 3: with the super funds, which is why they've been so
Speaker 3: laxed when it comes to cybersecurity. And I'm not saying this.
Speaker 3: The Australian Securities and Investments Commission is saying this. They
Speaker 3: set it back in January saying that your weak online
Speaker 3: security is exposing your members to scams. Do something about it.
Speaker 3: And rather than doing something about it, the Association of
Speaker 3: Super Funds Off Australia CEO said, you're raising unnecessary alarm.
Speaker 3: Super funds are the safest places in Australia to put
Speaker 3: your money. So nothing happened and as a result we've
Speaker 3: now seen this huge cyber attack because they thought, well
Speaker 3: it's only a little problem. Well little problems can turn
Speaker 3: into big problems. To paraphrase Paul Kelly, from little things,
Speaker 3: big things grow and that is indeed what is happening.
Speaker 1: Four super funds were targeted by cyber criminals in the
Speaker 1: coordinated attack, Australian Super, Australian Retirement Trust HOST Plus and
Speaker 1: REST the retail employee's superannuation trust. They manage almost a
Speaker 1: trillion dollars in retirement savings on behalf of thousands of
Speaker 1: Australians like Joan, who's one of four Australian supercustomers confirmed
Speaker 1: to have lost money in the hack. Australian Super is
Speaker 1: still combing through the six hundred accounts that were breached,
Speaker 1: while other funds scramble to reassure their anxious customers.
Speaker 5: No suspicious transactions or changes have been detected on member accounts.
Speaker 2: We recognize how frustrating this can be and sincerely appreciate
Speaker 2: your patience. An unusually high spe can log in attempts.
Speaker 1: We are experiencing a high volume of calls to our
Speaker 1: contact center, resulting in a longer than normal wait time.
Speaker 1: So Jared, now we get to the mystery of why
Speaker 1: police weren't involved right from the beginning. What are you
Speaker 1: hearing now from Australian super about if or when the
Speaker 1: police were called.
Speaker 3: Well, the good news is that they have contact a
Speaker 3: Metaday to say that we have reported it to the AFP.
Speaker 3: Five days after the hackers struck they decided to call
Speaker 3: in the coppers and that was only because probably that
Speaker 3: we did a front page story saying they hadn't called
Speaker 3: the AFP, who, of course, are the federal agency tasks
Speaker 3: with investigating such crimes, because as we all know, they're
Speaker 3: the ones that we're able to track down the Russian
Speaker 3: hacker that was responsible for the medibank attack back in
Speaker 3: late twenty two.
Speaker 5: The AFP is undertaking covert measures and working around the
Speaker 5: clock with our domestic agencies and our international networks, including
Speaker 5: into POL. This is important because we believe those responsible
Speaker 5: for the breach are in Russia.
Speaker 3: Super funds, a lot of them, not all of them,
Speaker 3: but a lot of them are regulated by the Australian
Speaker 3: Prudential Regulatory Authority, and when these sort of hacks happen,
Speaker 3: APROA do a review and if they have found that
Speaker 3: your cyber defenses are inadequate or weak, then they can
Speaker 3: impose pretty harsh penalties, which is what they did with
Speaker 3: Medibank after their attack, and the same thing can happen here.
Speaker 3: The problem is we don't know what that is until
Speaker 3: probably potentially weeks or even months after the event, until
Speaker 3: the forensic analysis has been done. APRA comes in and
Speaker 3: does their investigation, and all that is very poor comfort
Speaker 3: to members who the reason why they're with an industry
Speaker 3: super fun to begin with is they're there to profit members,
Speaker 3: not themselves, and any fines are taken from the member's
Speaker 3: pot of money. So they're up in arms say, well,
Speaker 3: what point is it to find the super funds. That's
Speaker 3: my money that you're taking away, and I've already been
Speaker 3: hit with this cyber attack, so it's almost like punishing
Speaker 3: the victims of crime.
Speaker 1: The other big threat to Australian superbalances right now is
Speaker 1: Donald Trump and his Liberation Day tariffs, which are draining
Speaker 1: money out of all our superbalances day to day. That's
Speaker 1: why hundreds of thousands of Australians are wanting to log
Speaker 1: on and look at their superbalances to see what's going on,
Speaker 1: to see how much money they've got left. Should the
Speaker 1: funds have to be able to deal with that kind
Speaker 1: of volume, Jared, Surely it's not out of the realm
Speaker 1: of consideration that everybody would want to log on all
Speaker 1: on the one day to see if their money is
Speaker 1: still there.
Speaker 3: You're absolutely spot on there if they're providing a service
Speaker 3: and they've got to make sure people access it. And
Speaker 3: when you look at a massive geopolitical event which is
Speaker 3: causing considerable anxiety, particularly as you approach preservation age where
Speaker 3: you're about to draw down on that super naturally you
Speaker 3: are going to want to check out what your balances
Speaker 3: are etc. Also, the closer you are to preservation age,
Speaker 3: the more vulnerable you are to scams because you're wanting
Speaker 3: to go in logging, work out how you're going to
Speaker 3: manage your money, etc. And that was one of the
Speaker 3: things Acid called out that super trustees had no way
Speaker 3: of knowing whether someone who was approaching preservation age was
Speaker 3: being tricked and a victim of a scam. And that
Speaker 3: was one thing that Acid called out back in January
Speaker 3: and which their lobby group said they're be an alarmist.
Speaker 3: There's nothing to see here. More or less.
Speaker 1: Coming up, the super fun say they're the safest place
Speaker 1: in the world to keep your money. Does that stack up, Jared?
Speaker 1: Because they have so much of Australian's money under management.
Speaker 1: Super funds are incredibly powerful as forces in our society
Speaker 1: in terms of what they do or don't invest in,
Speaker 1: what values they expect companies to uphold, if they're going
Speaker 1: to give them our money. What are we seeing do
Speaker 1: you think in the balance of the way super funds
Speaker 1: themselves operate and expect others to operate.
Speaker 3: So it's very much do as I say, not as
Speaker 3: do as I do. And one of the reasons why
Speaker 3: we haven't seen this big diversity, equity and inclusion pushback
Speaker 3: that we've seen happen in the US is because of
Speaker 3: Australia's super funds. Because they sit on about four trillion
Speaker 3: dollars worth of savings and use their enormous clout to
Speaker 3: push their own agenda onto Australia's top companies. That's just
Speaker 3: a reality. They're sitting on the biggest pot of retirement
Speaker 3: savings in the country and they're not afraid to flex
Speaker 3: that financial muscle, but when it comes to their own house,
Speaker 3: it's an absolute mess. They're saying it is one of
Speaker 3: the safest places in the country where you can park
Speaker 3: your money, and that is true, but what we've seen
Speaker 3: is their corporate governance is wanting. They are a soft target.
Speaker 3: They're sitting on trillions of dollars worth of retirement savings.
Speaker 3: That is a huge honeypot for hackers. And if they
Speaker 3: don't clean up their shop, make sure that they adopt
Speaker 3: the same level of governance that they demand from the
Speaker 3: likes of Wistech and other Australian companies, then our retirement
Speaker 3: savings are at risk to these sort of data breaches, attacks,
Speaker 3: you name it. They got to clean up their act.
Speaker 1: Jared Lynch is The Australian's Technology editor. You can read
Speaker 1: all our reporting on this hack and on the superannuation
Speaker 1: sector right now at the Australian dot com dot au