[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Data Breaches](/category/data-breaches) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Threat Monitoring for Superannuation Security](/blog/threat-monitoring-superannuation-security) Publish date September 20, 2026 {x} minute read # Threat Monitoring for Superannuation Security [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Greg Pollock](/team/greg-pollock) Director of Research and Insights Greg is a CISA-certified cybersecurity researcher who holds multiple patents for data leak detection. His findings have been featured in The New York Times, Forbes, and Wired. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) On April 4, 2025, The Australian Financial Review reported on a set of credential abuse attacks targeting multiple Australian superannuation funds. These attacks were not breaches of the infrastructure of those companies, but compromises of individual customer accounts via stolen credentials. How were those customer credentials stolen? The UpGuard Research team compared the number of affected accounts to the number of customer identities in infostealer logs over the past year and found evidence that this common method of credential compromise may have contributed to the account breaches. Furthermore, it suggests that effective monitoring of dark web data can help prevent such attacks from succeeding in the future.  ## A Coordinated Attack on Superannuation Funds As [reported by the AFR](https://www.afr.com/companies/financial-services/cyberattack-launched-on-major-australian-superannuation-funds-20250404-p5lp4l), “major industry funds Australian Retirement Trust, AustralianSuper, REST and Hostplus were all breached. Insignia, the owner of the 180-year-old MLC brand and the largest retail superannuation fund, also suffered a cyberattack.”  Not all companies have been affected equally. Thus far only AustralianSuper has confirmed customers losing money–around $100,000. The other funds have reported attackers targeting customer accounts but no losses. As we will see, AustralianSuper is also the company with the greatest exposure of customer passwords via infostealers.  In addition to disclosing whether customers lost any money, several funds also shared the number of customer accounts impacted in the attacks. The AFR reported 600 AustralianSuper accounts breached, 100 Insignia accounts, and up to 8000 REST accounts. Knowing the approximate number of accounts affected for each super allows us to compare that number to the number of customer passwords stolen by infostealer malware to determine whether that is a plausible vector in this attack. ## The Growing Threat of Infostealer Malware [UpGuard monitors the dark web](https://www.upguard.com/product/breach-risk/threat-monitoring) for credentials captured in infostealer (or just “stealer”) logs. The entries in infostealer logs include the user’s email or username, password, and the web address for the login page. Security teams can [scan a domain on the dark web](/tools/dark-web-scan) to see whether stealer logs already name them. [Monitoring infostealer data](https://www.upguard.com/blog/why-infostealer-malware-demands-a-new-defense-strategy) can thus tell a company when its employees or customers have had their passwords compromised. Passwords and other credentials collected by infostealers have been the cause of many recent high profile breaches, including those of AT\&T, Ticketmaster, and Santander. The number of accounts breached in the coordinated attack on these Australian superannuation funds is strikingly similar to the number of users for each service in stealer logs over the last year.   ## Comparing Affected Accounts to Compromised Users To start, we queried stealer logs including the login domains for each of the affected super. Insignia is here represented by their superannuation brand mlc.com.au. The member login for REST is on the domain aas.com.au.  The raw number of stealer logs mentioning each domain is around 300-3000 records for each company. While each of the records in UpGuard’s dark web database is unique, some are partial records that might include an identifier like device id but not the user’s email address. Records that are logically unique might also functionally overlap, like if the same user was compromised on multiple devices, or if a user's email address was included in one record and then later exposed again with the same email address and more information about them. To get a clearer picture of how many customers were actually exposed for each super fund, we narrowed the data down to records with a unique email address or a unique username. AustralianSuper had a reported 600 customers affected in the attack; over the last year, they had about 1000 customer credentials exposed via stealer logs. Insignia (MLC) reported 100 customers affected with about 150 customer credentials exposed. Those two sets of numbers are proportionally very similar, and when we factor in the assumption that some of those credentials would have been changed in the last year, the absolute numbers are quite close as well. Based on the data from these incidents, the number of customers in infostealer records is a useful predictor of number of customer accounts impacted in an attack. The number of accounts reported by REST (aas.com.au), on the other hand, is much higher than the number of customer passwords in stealer logs and about ten times the number of accounts affected at AustralianSuper. REST reported 8000 accounts affected; we see closer to 700 customer passwords in the stealer logs. This discrepancy may indicate that those accounts were being targeted with more brute force attacks like password spraying, or that the other superannuation funds who reported much lower numbers were effectively able to filter out those attacks and did not count them in the number of customers impacted. ## What Companies Can Do Without knowing the identities of the people affected, there is no way to confirm whether the credentials in these stealer logs correspond to the individuals affected. However, when we see two companies where the number of affected accounts is so close to the number of identities exposed, it’s clear why monitoring for infostealer exposure has become a must-have capability for threat intelligence teams. Customer credentials are being traded for hundreds of customers of these superannuation funds every year. Companies can monitor for those exposures and reduce the likelihood of impact to their customers.  Additionally, multi-factor authentication is a vital defense against account compromise. There are no silver bullets, but MFA introduces a significant barrier to abusing credentials. MFA should be a requirement for any application with access to anything of value, whether that be sensitive personal information, corporate secrets, or bank funds. These attacks should serve to illustrate why both multifactor authentication and robust threat monitoring are worthwhile practices to maintain customer trust. ‍ eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [How to Prevent Data Breaches in 2026 (Highly Effective Strategy)](/blog/prevent-data-breaches) Learn how to implement an effective security control strategy for defending against data breaches in 2026. [](/team/edward-kost) [Edward Kost](#) October 26, 2026 Attack Surface Management #### [Attack Surface Management Vendors Compared](/blog/attack-surface-management-vendors-compared) We compared ASM vendors and helped you rate them before agreeing to a POC! [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Attack Surface Management #### [The Blind Spot in Brand Protection: Why App Stores Slip Past Standard Monitoring](/blog/the-blind-spot-in-brand-protection-why-app-stores-slip-past-standard-monitoring) Do Brand Protection Solutions scan the Apple App Store and Google Play? Don't wait to find out. [](/team/lance-turner) [Lance Turner](#) September 22, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)