Bendigo Bank Faces $8M Penalty for Cybersecurity Failures

• •Bendigo Bank admitted to breaching BEAR obligations after a 2023 cyber attack.
• •The attack compromised 257 customer accounts and resulted in $490,000 in unauthorized transactions.
• •APRA seeks an $8 million penalty, highlighting the need for strong cybersecurity measures.

Bendigo and Adelaide Bank has admitted to breaching its obligations under the Banking Executive Accountability Regime (BEAR) following a cyber attack on its Alliance Bank business in March 2023. An unidentified threat actor accessed approximately 257 customer accounts and executed 286 unauthorized transactions totaling $490,000. The attack exploited significant weaknesses in customer authentication controls, including weak password settings and system flaws that allowed the identification of valid customer IDs. Despite identifying some of these weaknesses during penetration testing in 2020, the bank failed to address them before the attack. APRA has initiated civil penalty proceedings in the Federal Court, seeking an $8 million penalty, which is subject to court approval. Bendigo Bank has since remediated the identified weaknesses and currently has no concerns regarding its information security controls. APRA emphasizes the importance of robust cybersecurity practices for major financial institutions.