ASFA CEO, Mary Delahunty’s, opening remarks to the BFSI Innovation and IT Summit
SYDNEY, 15 APRIL 2026
Good morning, thank you for the warm introduction, and thank you for having me.
For those of you I haven’t met, I’m Mary Delahunty, CEO of the Association of Superannuation Funds of Australia, ASFA.
ASFA is the voice of super. Since 1962 we have been the representative body for professionally managed super funds of all types and their service providers – administrators, insurers, custodians and other providers from across the sector.
We convene the superannuation sector to lead on the issues that no one organisation can solve alone.
And in an increasingly interconnected world and financial system, cyber resilience and financial crime sit firmly in that category – and has never been so important.
When we talk about superannuation, we often talk in very large numbers.
Trillions of dollars.
Millions of transactions.
Hundreds of funds and service providers.
But behind all of that, are people.
Almost 18 million Australians with superannuation accounts. For most, their super is one of the largest financial assets they will ever hold.
From humble but ambitious beginnings, this incredible system is now the fourth largest pension system in the world, and it is built on trust. The trust from those many millions of Australians that we will keep their money safe, grow it, and ensure it is there to support a dignified retirement at the end of their working lives.
And super IS trusted. A part of our role as the peak body is to measure sentiment in the community for the sector we represent. Every year, ASFA polls a statistically significant number of Australians on a range of issues relating to super.
One question we ask is whether they trust their superannuation fund to manage their money for retirement. 82% of people do.
77% trusted their fund to always look out for their best financial interests.
And 78% trusted their fund to keep their personal data safe.
This trust is hard won. And it is why, as a system, we need to be proactive. Because if something goes wrong, trust can be lost quickly, and the strength of the system with it.
We saw that trust tested in April last year, when – for the first time – super experienced a coordinated cyber incident.
Criminals undertook a well-funded and multi-faceted attack on the super system over a period of a number of weeks. They used stolen or approximated email addresses and passwords in a mass credential stuffing action to attempt to access accounts. There was a relatively small number of successful actions, a few accounts were accessed, fewer still had funds extracted. Largely our systems held and the incident was relatively contained but it reinforced our responsibility to learn from these moments and ensure we continue to strengthen the system through a systems thinking lens, – beyond a collection of individual entities.
The opportunity that this regrettable incident presented was one of critical evaluation.
Each fund has strong defence system in place, APRA has been an influential regulator in this area and they have driven enormous uplift of capability across all superannuation entities. Each fund, and by contractual obligation, each critical service provider has information security requirements that are befitting the worlds fourth largest pension pool of savings. Continuous improvement is expected from the people of Australia, and the regulator, and will be prioritised.
So what are the opportunities for uplift that allow us to stay one step ahead of those who seek to part the people of Australia from their hard earned retirement savings?
After the incident, ASFA conducted a sector-wide ‘lessons’ review to collect information from CEOs and senior Information Security Executives within funds and critical services providers and the message was clear, we can be better prepared if we are better coordinated.
It is an opportunity that ASFA as the Association, together with other sub-sector bodies and other associations, can help to exploit. By adding a layer of intentional coordination across the sector we can strengthen the resilience and we can strengthen the response.
At the time of the April incident the sector didn’t have structured systems in place to communicate between technical teams at different funds.
We didn’t have a trusted channel for communications teams across funds to coordinate so information about the incident was delivered inconsistently, at times emerging through media reporting in a way that heightened member concern, rather than providing reassurance. Super took a reputational hit.
Now imagine that same incident…. but in a system where information about risks doesn’t stay within organisations – it moves across the whole sector in a speedy and consistent manner.
And where there is a clear blueprint for how the sector comes together and responds in those moments.
That is the difference we are working to build.
Through the, Superannuation Cyber and Financial Crime Coordination, SC3, framework.
SC3 is the super sector’s coordinated response to cyber threats, scams and financial crime.
It is designed to bring together the strength of individual organisations to build collective resilience at a system level.
The Framework is made up four core pillars, which are intended to reinforce one another, to significantly increase the sector’s cyber and financial crime resilience.
The first of those pillars is a sector-wide cyber threat intelligence capability, the Superannuation Cyber and Financial Crime Exchange, or SuperFCX.
SuperFCX is designed to gather, analyse and share actionable threat intelligence through a superannuation lens, supporting earlier visibility of threats and more informed responses across the super sector.
To enable this to operate within Australian competition law we have applied for ACCC authorisation for the platform. That is currently sitting with the competition regulator.
The second is the Super Sector Cyber Incident Response Playbook.
Two dedicated cross-sector working groups are developing together how the sector will coordinate and communicate during a significant cyber incident – providing clarity on roles, escalation pathways and consistent messaging, while recognising that funds retain responsibility for their own regulatory and member communications.
The third is the Super Sector Response Exercises.
We will be undertaking the most comprehensive exercise the sector has ever contemplated in September this year and annually after that. Regular exercises allow the sector to practise coordinated responses to realistic scenarios, testing how we work together in real time and how the Playbook operates in practice, while identifying areas to strengthen system-wide preparedness.
And fourth pillar underpinning all of these initiatives are the forums and specialist working groups, bringing together expertise from across the sector to support coordination and shared learning.
The impact of getting this right is significant and we know this matters to Australians.
Our research shows that keeping money safe from criminal activity is second only to investment returns as a priority for super fund members.
More than one in five Australians say it is the most important feature of their fund.
It is a core expectation on us.
Settling this work will also help us deal with emerging risks more effectively, I’m sure we are all watching with interest the Anthropic Mythos model and the reckoning that it is apparently bringing in cyber security. I’m sure you, like me, have been devouring any coverage you can on this, on glasswing, including recent reports that US Treasury Secretary Scott Bessent gathered financial sector leaders together to deliver a stark message about the potential dangers of AI models deployed internally posing a serious risk to sensitive customer data – we must hear that warning here as well. We can also learn from this my real message today, that traditional competitors are expected to find ways to work together to combat cyber risks.
The job of our association is to consider how to contend with these increasing risks as a whole of sector response.
Super has some natural defences worth remembering – firstly all of us with a super account have entered into a tax concessional system that holds as a central tenet the concept of preservation. Meaning that the money is difficult move out of super unless a condition of release has been satisfied, most commonly the age of the account holder. That somewhat lessens the risk to individuals of losing money in mass attacks, but the compulsory nature of super and that feeling that you can’t access it for a long time can breed disengagement making the risks of investment scams, potentially using stolen data from elsewhere a meaningful threat we need to deal with.
Let’s throw in market volatility – why? Well it matters to the risk profile. I don’t think it was any coincidence that the credential stuffing incident I described earlier was attempted at the same time as a known market shock was rippling through economies – Liberation Day. There is a significant enough body of evidence linking times of economic volatility and the high trading or panic that can often accompany this, with increased cybercrime.
Much will be written about the years we are in right now, among other observations they will be defined as economically volatile and in large financial institutions the high activity increases the risk for us and the need for vigilance.
Cyber and financial criminals exploit fragmentation. They look for the weakest point.
Which means the question is no longer: How strong are we individually? It is: How strong are we collectively?
And while ASFA’s work on the SC3 framework is grounded in super, the implications are broader – because super does not operate in isolation.
We are connected to banking.
To insurance.
To payments infrastructure.
To government systems.
And while there is a clear expectation from government and regulators that sectors like ours strengthen coordination, it is not the only driver for change.
It is also coming from the people who rely on this system every day and place their trust in us.
So coming back to today’s theme – as we build the “future of finance”, and “move toward more connected systems”, the way we protect the trust placed in us, must evolve with that.
Because when 18 million Australians are relying on us to get this right, getting this right is not optional.
