Bendigo and Adelaide Bank has acknowledged failures under the banking executive accountability regime in connection with a 2023 cyber incident affecting its Alliance Bank unit.
The matter relates to “significant weaknesses” in online banking authentication, the Australian Prudential Regulation Authority (APRA) said
These included password rules that allowed extremely weak passwords, cases where different customers had the same password, and design issues that allowed an attacker to work out valid customer IDs. Some of these problems had already been flagged in penetration testing in 2020, but Bendigo Bank did not fix them before the attack, the regulator noted. Between 3 and 7 March 2023, an unknown hacker accessed about 257 customer accounts.
Over that period, 286 unauthorised transactions worth roughly A$490,000 were carried out, affecting 87 Alliance Bank customers. The bank could not recover about A$140,000, although it repaid all customers who were impacted. After a formal investigation, APRA filed civil penalty proceedings in the federal court.