Episode Details
Back to Episodes
Bendigo Bank - 1,598 Accounts, One Password, and the $8 Million Bill That Arrived Three Years Later
Description
On 11 August 2026, Bendigo and Adelaide Bank accepted a proposed $8 million penalty over a March 2023 cyber attack on Service One Alliance Bank. The court documents contain a sentence worth reading twice: at the time the attack began, 1,598 customer accounts were protected by the password 123456.
The timeline. 2020: penetration testing identifies security weaknesses in the Alliance Bank environment. Not remediated. October 2022: a threat actor attempts brute-force login attacks and fails; the board is told the bank is at a critical point of needing further investment in resourcing and capability. No substantive review is undertaken. March 2023: an unidentified attacker brute-forces approximately 257 customer accounts. 10 August 2026: APRA files an Originating Application in the Federal Court. 11 August 2026: APRA announces publicly and Bendigo lodges an ASX announcement accepting the proposed penalty.
The numbers - all official, from APRA, the Federal Court filing and Bendigo's ASX announcement, none of them threat-actor claims: 257 accounts accessed; 286 unauthorised transactions; 87 customers affected by a transaction; approximately $490,000 misappropriated; about $140,000 unrecoverable; all customers fully reimbursed; 1,598 accounts using 123456; an $8m proposed penalty; and about $2.6m in additional legal costs.
The three named control weaknesses: password settings permitting very weak passwords; multiple accounts protected by identical passwords; and system design that enabled the attacker to identify valid customer IDs - account enumeration.
The regulatory angle. This is not an OAIC or Notifiable Data Breaches matter, because no bulk personal information was taken. The regulator is APRA and the instrument is the Banking Executive Accountability Regime. All four admitted failures are governance failures: inadequate authentication controls, no systematic testing programme, accountable persons' responsibilities not covering the Alliance Bank IT system, and inadequate information security governance.
Attribution: none. APRA and the court documents describe an unidentified threat actor. No group claimed it, no data was published, no ransomware was involved.
Five lessons. One: a penetration test you don't remediate is worse than no penetration test - it is a dated written record that you were told. Two: treat a failed attack as a real incident; October 2022 was a rehearsal nobody reviewed. Three: password policy isn't solved because you assume it is - go and measure it, and make MFA default rather than optional. Four: account enumeration is a vulnerability, not a UX detail - identical responses and identical timing, whether or not the account exists. Five: outsourced, white-labelled or subsidiary IT still carries your accountability, so put a person's name, not a team's, against every system your customers touch.
The penalty is roughly 16 times the amount stolen. It isn't for the loss; it's for the three years between the finding and the fix.
Visit www.kinsoft.com.au to talk through your security and IT needs.
Sources: APRA media release, Bendigo and Adelaide Bank admits breaching its BEAR obligations, 11 August 2026; APRA Originating Application, Federal Court of Australia, stamped and redacted, 10 August 2026; Bendigo and Adelaide Bank ASX announcement, 11 August 2026; Information Age (Australian Computer Society), 12 August 2026; Cyber Daily, 11 August 2026; FST Media; Lawyerly; Mortgage Professional Australia.