Cybercriminals Steal Staff Logins from Major Australian Banks, Raising Risk of Data Breaches and Ransomware
Nearly 100 employee logins from staff at Australia’s largest banks have been stolen by cybercriminals, increasing the potential for significant data breaches and ransomware attacks, according to cybersecurity analysts.
Experts have warned that the most severe threats stem from attackers potentially using these compromised credentials to infiltrate the banks’ internal systems.
Cyber intelligence firm Hudson Rock informed the ABC that it had uncovered dozens of compromised staff logins at both ANZ and the Commonwealth Bank, with fewer than five each at NAB and Westpac.
“There are roughly 100 compromised accounts linked to these four banks,” said Hudson Rock analyst Leonid Rozenberg.
While all four institutions have security systems designed to prevent unauthorized access using stolen passwords, the stolen credentials could still provide cybercriminals with what is called “initial access” into corporate systems.
“This is essentially an open gate,” Rozenberg explained, adding that once inside, hackers could cause extensive damage—such as deploying ransomware and stealing vast amounts of customer data. The compromised credentials include those of both current and former employees and contractors, all of whom had corporate email addresses tied to domains like “anz.com.au” or “cba.com.au.”
The credentials, obtained through malware known as “infostealers,” were harvested from infected employee devices between 2021 and April 2025. They were later traded or shared on platforms like Telegram and the dark web.
Infostealers are malicious programs designed to extract sensitive data from infected systems and transmit it to cybercriminals. These programs typically target Windows devices and can capture not just passwords, but also credit card numbers, cryptocurrency wallets, browser cookies, browsing histories, and locally stored files.
Although no evidence has surfaced suggesting the banks’ infrastructure itself has been breached, researchers have confirmed that staff login data was taken from employee devices.
One Breach Can Lead to Major Consequences
Earlier this week, similar malware attacks exposed other victims to fraud. While employee credential leaks are far fewer than customer leaks, experts argue they pose a more serious threat.
“You only need one compromised login to cause a lot of damage,” Rozenberg said.
A recent report by the Australian Signals Directorate (ASD) emphasized the serious consequences infostealer infections can have for businesses. The ASD revealed that stolen business credentials have already resulted in successful attacks, though it didn’t specify which organizations were affected.
Additionally, Hudson Rock discovered that each of the four banks had compromised credentials from third-party service providers, adding another layer of risk.
“They’re not just after access to the banks—they’re also going after the third-party services those banks rely on,” Rozenberg said.
In the case of Commonwealth Bank, more than 40 third-party credentials were compromised. Researchers also found over 30 at Westpac, over 100 at ANZ, and more than 70 at NAB.
“Attackers know that infiltrating tools like JIRA, Salesforce, or Slack can yield a wealth of sensitive information,” Rozenberg noted.
Though this particular investigation focused on banks, the threat of infostealers applies across all industries and regions.
“This malware can affect any organization, regardless of industry or country,” Rozenberg warned.
Hudson Rock reported that global infostealer infections have surged over 200 times since 2018, with over 58,000 infections identified in Australia since 2021.
How Stolen Credentials Lead to Breaches
Successfully executing a large-scale cyberattack involves more than just having stolen login credentials.
“Most big enterprises implement extra security layers beyond a username and password,” said Evan Vougdis of NSB Cyber, citing Multi-Factor Authentication (MFA) as an example.
As such, gaining “initial access” has become a specialized role in cybercrime, handled by “initial access brokers.”
These brokers sift through massive data leaks, searching for corporate logins—ideally from remote workers—linked to VPNs, remote desktop tools, and software accounts.
“They aim to pivot from a home device into the corporate network, essentially walking through the front door,” explained Jamie O’Reilly from cybersecurity firm Dvuln.
Once access is gained, it’s often sold to ransomware groups who then infiltrate the organization and deploy malware.
Such ransomware attacks can cripple businesses by locking them out of their systems and stealing critical data to demand multimillion-dollar ransoms. Even if payments are made, the stolen data may still end up on the dark web, as there’s no guarantee it will be destroyed.
Banks Respond: Security Measures in Place
In separate responses to the ABC, ANZ, Commonwealth Bank, NAB, and Westpac emphasized that they have multiple defenses in place to prevent unauthorized access through stolen credentials.
A Westpac spokesperson declined to detail these measures, citing security concerns.
NAB said it actively monitors cybercrime forums to detect threats.
“We routinely monitor both the open and dark web for signs of compromised credentials,” said NAB Chief Security Officer Sandro Bucchianeri. “Passwords for staff and third parties are updated regularly.”
Commonwealth Bank noted it invested over $800 million last financial year in its fight against cyber and financial crimes.
“We constantly adjust our defenses based on real-time threat data and regularly test our security systems,” a spokesperson stated.
