Retirement funds reportedly raided after unexplained portal probes and data theft

Multiple Australian superannuation funds were targeted in a coordinated cybercrime campaign in late March 2025: attackers attempted unauthorized access to member portals, with at least one fund (Rest) reporting limited personal details for about 8,000 members accessed and other funds reporting illicit withdrawals. The activity appears to have relied on stolen credentials and abuse of authentication processes (e.g., SMS/OTP timing), prompting funds and the industry body (ASFA) to notify affected members and investigate.