Bendigo Bank to Pay A$8M Over Alliance Bank Cyberattack
Synopsis
Bendigo and Adelaide Bank admitted breaching its banking accountability obligations after failing to fix authentication weaknesses identified in 2020, allowing an attacker to access 257 Alliance Bank accounts and make 286 unauthorised transactions worth A$490,000 in 2023.
The Federal Court has ordered for evidence to be presented in the $8 million penalty proceedings against Bendigo Bank for breaching its accountability obligations stemming from the cyber incident involving Alliance Bank in 2023.
The proposed A$8 million penalty by APRA is due to shortcomings in customer authentication, security testing, information-security governance and accountabilities, and executive responsibility, which must be approved by the court.
257 Accounts Accessed in 2023
The Bendigo Bank penalty by APRA follows the attack occurring between March 3 and March 7, 2023, involving the theft of funds from 257 customers’ accounts. The unauthorized transactions totaling A$490,000 were conducted by an unidentified hacker who accessed 286 accounts.
As a result, 87 customers were affected by the data breach at Alliance Bank, with all of them reimbursed by Bendigo Bank, although A$140,000 was unrecoverable.
The penetration testing conducted in 2020 had already identified several authentication weaknesses, including the ease of application of very simple passwords, the same passwords on different accounts, and the possibility for security features to be used to identify genuine customers, according to APRA.
These weaknesses were not remedied before the attack occurred, and the bank resolved the identified deficiencies in controls and has no concerns about the bank’s information-security controls.
Cyber Risk Remains a Major Banking Concern
Given that cyber risk is a primary concern for the Australian financial sector, the Bendigo Adelaide Bank penalty is not a surprise. Indeed, in 2025, in APRA’s Stakeholder Survey, 91% of banks, insurers, and superannuation trustees identified cyber risk as a high or critical business risk, compared to 20 percentage points higher than the second-highest risk.
APRA notes that Bendigo Bank has capital and liquidity levels well above minimum requirements and is in a sound financial position. As of now, APRA’s prudential oversight ensures that the entity administering the deposits of A$9.8 trillion on behalf of depositors, policyholders, and superannuation fund members is fit and proper.
For the same period, the bank recorded a statutory net profit of A$$256.4 million in cash earnings and A$230.6 million after tax. The bank’s latest trading update also showed cash earnings of A$120.7 million for the September 2025 quarter, although they were unaudited.
Source: Capital Brief
Pooja Malik is a business journalist with over six years of experience covering startups, entrepreneurship, and emerging trends. She has previously worked with leading media platforms such as YourStory Media and BW BusinessWorld, where she reported on business, policy, and market developments. Currently, she serves as Editor at The Inspirepreneur Magazine, where she writes and edits stories across business, lifestyle, and travel, with a focus on clarity, accuracy, and reader relevance.
