Bendigo and Adelaide Bank admits to breaching its BEAR obligations

APRA announced on 11 August 2026 that Bendigo and Adelaide Bank Limited has admitted breaching its obligations under the Banking Executive Accountability Regime in connection with a 2023 cyber attack affecting its Alliance Bank business. APRA commenced civil penalty proceedings against the bank in the Federal Court on 10 August 2026, and the parties filed an agreed statement of facts and admissions.

The admitted facts describe significant weaknesses in customer authentication controls for Alliance Bank online banking, including password settings that permitted very weak passwords, multiple customer accounts sharing identical passwords, and system design features that allowed a threat actor to identify valid customer identifications. A number of these weaknesses had been identified by penetration testing conducted in 2020 but were not addressed before the attack. Between 3 and 7 March 2023, an unidentified attacker gained access to approximately 257 customer accounts and made 286 unauthorised transactions totalling around 490,000 dollars affecting 87 customers; Bendigo Bank was unable to recover about 140,000 dollars of this amount but reimbursed all affected customers.

Bendigo Bank has admitted failing to maintain adequate customer authentication controls and failing to undertake a systematic testing program for those controls, in breach of its obligations under the Banking Act 1959 that underpin the Banking Executive Accountability Regime. The matter remains before the Federal Court for determination of penalty. It illustrates that a cyber incident traced to inadequate technical controls can itself found an accountability regime contravention, separate from any direct consumer harm claims arising from the same incident.