On 11 August 2026, Bendigo and Adelaide Bank accepted a proposed $8 million penalty over a March 2023 cyber attack on Service One Alliance Bank. The court documents contain a sentence worth reading twice: at the time the attack began, 1,598 customer accounts were protected by the password 123456.

The timeline. 2020: penetration testing identifies security weaknesses in the Alliance Bank environment. Not remediated. October 2022: a threat actor attempts brute-force login attacks and fails; the board is told the bank is at a critical point of needing further investment in resourcing and capability. No substantive review is undertaken. March 2023: an unidentified attacker brute-forces approximately 257 customer accounts. 10 August 2026: APRA files an Originating Application in the Federal Court. 11 August 2026: APRA announces publicly a ...