Bendigo Bank Faces Regulatory Action After 2023 Cyber Breach Exploiting Unaddressed Vulnerabilities Between 3 and 7 March 2023, a hacker exploited weak customer authentication controls in Bendigo Bank’s Alliance Bank business, accessing 257 customer accounts and executing 286 unauthorized transactions totaling $490,000, affecting 87 customers. The breach stemmed from vulnerabilities flagged during a 2020 penetration test that remained unaddressed. In response, Bendigo Bank reimbursed all affected customers and proposed an $8 million pecuniary penalty, pending Federal Court approval. However, the incident triggered heightened scrutiny from the Australian Prudential Regulation Authority (APRA), which imposed formal licence conditions on the bank following an independent Deloitte root cause analysis commissioned in December 2025. The review uncovered "prevalent" non-financial risk management weaknesses across the organization, including material deficiencies in governance, accountability, and risk oversight issues that persisted despite years of remediation under the bank’s BEN+ transformation program. While APRA Deputy Chair Therese McCarthy Hockey confirmed the bank remains financially sound, she emphasized that as Australia’s sixth-largest bank, Bendigo must maintain "robust and sophisticated cybersecurity systems." The new licence conditions require a comprehensive rectification program and independent assurance, alongside a retained $50 million operational risk capital add-on. Though APRA has not raised concerns about the bank’s current information security controls, the enforcement actions signal ongoing supervisory attention that may impact service levels or product settings in the coming months. Bendigo Bank also admitted breaching the Banking Executive Accountability Regime (BEAR) in relation to the attack, marking the second regulatory action against the bank in a week. While the immediate financial impact is limited, the dual enforcement actions underscore longstanding risk management concerns that the bank has pledged to address through cooperative engagement with regulators.