You’d think something this big would be front-page material. But in what feels more like a plot from a high-stakes cyber-heist movie, more than 31,000 banking passwords belonging to customers of Australia’s “Big Four” banks have been stolen—and they’re now being shared like freebies on the dark web.
Yes, that includes Commonwealth, ANZ, NAB, and Westpac. None were spared.
This massive leak has put tens of thousands of Australians at serious risk of identity theft and financial fraud. The kicker? The breach didn’t come from inside the banks—it came from our own devices.
The Silent Heist: How It All Happened
According to a recent ABC report, cybercriminals quietly collected login credentials from thousands of Australians. That includes 14,000 Commonwealth Bank customers, 7,000 ANZ customers, 5,000 from NAB, and another 4,000 Westpac users.
So, where did the stolen banking passwords data end up? On Telegram and dark web forums—often shared for free to lure in new criminal buyers. It’s a marketing strategy in the underworld: give them a freebie, and they’ll come back for more.
Cybersecurity firm Dvuln uncovered the breach. They say it wasn’t a typical phishing scam. Instead, hackers used stealthy malware known as an “infostealer.” Think of it like spyware—only more aggressive. Once installed, it quietly scoops up banking passwords, credit card details, crypto wallet keys, and browser logins.
There are no pop-ups, no alerts—just silent data theft.
“This is not a vulnerability in the banks,” explained Jamie O’Reilly, Dvuln’s founder. “These are customer devices that have been infected.”
The Growing Infostealer Epidemic
The Australian Cyber Security Directorate is calling it “the silent heist”—and it’s easy to see why. Most victims don’t even realise they’ve been compromised until it’s too late. Their accounts are already breached.
And the numbers? Alarming.
Hudson Rock reports that over 58,000 devices in Australia are currently infected. Globally, that number has exploded to more than 31 million. Back in 2018, it was just 135,000.
“We’ve seen a tight correlation between the use of infostealer malware and using those passwords to conduct these types of attacks,” O’Reilly told the ABC.
What’s worse is how long these infections remain useful to criminals. Dvuln found some compromised devices had been infected as far back as 2021. O’Reilly’s team has even used passwords that were four or five years old to breach ASX-listed companies.
Once your credentials are out there, they don’t expire. Hackers are patient—and persistent.
A Thriving Market for Stolen Logins
Here’s where it gets even more worrying: stolen login details are dirt cheap.
Cybercrime groups offer subscriptions for as little as US$400 (around AU$626) per month, giving buyers access to between 100,000 and 200,000 freshly infected devices.
Some go a step further, offering “lifetime access” to stolen data for US$3,000 to US$10,000. The supply is so abundant, many credentials are handed out free as bait.
“The criminals have so many passwords and so much data, that they actually give away thousands and thousands of credentials just to entice new criminal customers,” O’Reilly explained.
How Australians Can Protect Their Banking Information
The Australian Banking Association (ABA) says the banks aren’t to blame. The breach stems from malware that targets individuals, not banking systems.
ABA CEO Anna Bligh said, “Keeping customers secure online is the top priority for Australia’s banks. They continue to invest in security defences to help keep customers safe, including using advanced intelligence systems to monitor both open and dark web sources for compromised customer credentials.”
Commonwealth Bank added that it has additional security layers in place, including real-time fraud monitoring and transaction blocking.
But experts say password changes alone aren’t enough. If your device is infected, it doesn’t matter how strong your new password is.
“It’s the equivalent of changing your locks while the burglars are still in your house,” O’Reilly noted.
What You Can Do Right Now to Stay Safe
Security experts say prevention is key. Here’s what you can do:
- Change your passwords—but do it from a clean device.
If your current device might be compromised, use another one to change your banking credentials. Don’t hand fresh logins straight to malware. - Keep your software and antivirus updated.
Around half of infected devices had antivirus installed—it just wasn’t current. Updates matter more than you think. - Separate sensitive tasks.
Don’t do your banking on the same laptop your kids use to download games or mods. Stick to a clean, dedicated device. - Enable multi-factor authentication (MFA).
It won’t stop everything, but it adds an extra barrier for attackers. - Check your accounts regularly.
Look over your bank statements and turn on transaction alerts. The sooner you spot suspicious activity, the better. - Act fast if something feels off.
Notice anything weird? Contact your bank immediately. Time matters in these situations.
By staying vigilant and taking action now, you can cut off hackers before they make you their next target.
The Broader Implications for Cybersecurity
This breach isn’t happening in a vacuum. It follows a string of recent cyberattacks on Australian super funds, where hackers used leaked passwords to drain accounts—many belonging to pensioners. It’s grim stuff, and experts say it’s just the latest sign of how savvy and aggressive cybercriminals have become when targeting our financial systems.
The banking password leak also throws a harsh spotlight on the constant pressure Australia’s Big Four banks are under. They’re in a nonstop race to upgrade security—because the threats? They’re evolving by the day.
But here’s the kicker: it’s not just on the banks anymore. These days, everyone has skin in the game. From customers to corporations, the burden of staying safe online is shared. The era of “just use a strong password” is over. Now, it’s about layered security, staying alert, and realizing that yes—this could happen to you too.
About Infostealer Malware
Infostealer malware, as the name suggests, is specifically designed to steal information from infected devices. It primarily targets Windows computers and can capture:
- Banking credentials and passwords
- Credit card details
- Cryptocurrency wallets
- Local files
- Browser data (cookies, history, autofill information)
The malware is typically spread through:
- Phishing emails
- Malicious links
- Deceptive advertisements
- Unofficial software downloads
- Gaming modifications (mods)
- Pirated software
Once a device is infected, the malware operates silently in the background, harvesting data and sending it directly to cybercriminals without the user’s knowledge.
