TL;DR: Over the weekend of 29–30 March 2025, attackers hit several big super funds: Rest, Hostplus, Australian Retirement Trust, AustralianSuper and Insignia (MLC). Methods included credential stuffing (logging in with passwords stolen elsewhere). AustralianSuper said up to 600 members’ stolen passwords may have been used; Rest reported roughly 8,000–20,000 members affected. Reports suggest pension-phase accounts were targeted. Turn on MFA and use a unique password for your super.
What happened
From Investor Daily:
| Fund | What was reported |
|---|---|
| Rest | Unauthorised activity on Member Access; about 1% of members (reports range 8,000 to 20,000); no funds withdrawn |
| AustralianSuper | Up to 600 members’ stolen passwords may have been used; changes to card and banking details restricted |
| Insignia (MLC) | Confirmed credential stuffing on its Expand platform; no financial impact; some customers prompted to reset passwords |
| Hostplus, ART | Also affected; numbers not stated |
Media reports suggest attackers focused on pension-phase accounts, which can request lump-sum withdrawals.
Why super is a juicy target
Many people log in to super once a year, if that. The password is often old and reused. And unlike a bank account, you might not notice a change for months. For a thief, that’s a big balance with a sleepy owner.
What the industry did
- Affected accounts were locked or restricted and owners contacted.
- AustralianSuper contacted the National Cyber Security Coordinator’s office.
- ASFA called for industry-wide security frameworks and information sharing.
How to protect your super
- Turn on MFA in your fund’s member portal or app.
- Use a unique password that you’ve never used anywhere else (password managers help).
- Log in a few times a year: check contact details, bank details and any pending requests.
- Watch for "super fund" phishing that asks you to log in via a link.
- Check breaches: our free exposure checker shows which of your old passwords may be circulating.
What each fund said
TechRadar gathered the funds’ statements in April 2025:
| Fund | What it reported |
|---|---|
| AustralianSuper | Around 600 member passwords stolen and used to try to commit fraud; affected accounts locked |
| Rest | About 20,000 accounts affected; member portal shut down |
| Australian Retirement Trust | "Unusual login activity" on several hundred accounts; no withdrawals attempted |
| Insignia, Hostplus | Confirmed they were targeted |
Reuters, citing an anonymous source, reported four members had a combined $500,000 withdrawn. The funds didn’t confirm which members or fund.
AustralianSuper’s advice to members was simple: set a new, stronger password and check your balance. Both take five minutes.
If something looks wrong
Call your fund using the number on its website, not one from an email. Ask it to lock changes while it investigates. Report to ReportCyber, and call the ATO (1800 467 033) if your TFN may be involved (TFN guide).
Related: ASIC’s review of super fund scam protections and the 2024 retail credential stuffing wave.
Frequently Asked Questions
How much was stolen in the March 2025 super fund attacks?
Reuters, citing an anonymous source, reported four members had a combined $500,000 withdrawn. AustralianSuper said about 600 member passwords were used in attempted fraud.
Which super funds were attacked in 2025?
Rest, Hostplus, Australian Retirement Trust, AustralianSuper and Insignia (MLC) reported attacks around 29–30 March 2025.
Was money stolen from super funds?
Rest said no funds were withdrawn and Insignia reported no financial impact. The report didn’t state amounts for other funds.
How did attackers get into super accounts?
Insignia confirmed credential stuffing; AustralianSuper said stolen passwords were used.
How do I protect my super account?
Turn on MFA, use a unique password and check your account details regularly.
Sources
- TechRadar: Australia's largest pension funds hit by hackers (Apr 2025)
- Investor Daily: Cyber attack targets Australia's largest super funds