Commonwealth Bank of Australia

Summary

A cyber incident at Commonwealth Bank of Australia's Indonesian subsidiary involved unauthorized access to a web-based project management application, prompting an investigation and remediation efforts. Services at the affected subsidiary remained operational throughout the incident, with no impact reported on the parent bank's segregated systems. The parent organization provided support while maintaining oversight of the response to the security breach.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In early March 2023, Commonwealth Bank of Australia (CBA) disclosed a cybersecurity incident affecting its Indonesian subsidiary, PT Bank Commonwealth (PTBC). The breach involved unauthorized access to a web-based software application utilized by PTBC for project management activities. CBA became aware of the intrusion through PTBC’s internal detection mechanisms, though the exact timeline of initial access and discovery was not publicly detailed. Upon identification, PTBC activated its response protocols, engaging technical teams to investigate the scope and origin of the incident. The parent bank emphasized that its own systems remained operationally segregated from PTBC’s infrastructure, insulating CBA’s Australian and global operations from direct compromise. Customer-facing banking services at PTBC continued without interruption, indicating no immediate disruption to transactions, account access, or digital platforms. The breach appeared confined to the targeted project management application, with no evidence suggesting broader infiltration of PTBC’s core banking systems or customer databases at the time of disclosure.

CBA coordinated closely with PTBC’s management and cybersecurity personnel to assess the incident’s technical and operational ramifications. Public statements confirmed collaborative efforts to contain the unauthorized access, though forensic analysis did not initially reveal whether sensitive data was exfiltrated or compromised. PTBC maintained normal branch operations and customer service channels throughout the response, prioritizing business continuity while mitigating risks associated with the application breach. The segregation between CBA’s and PTBC’s systems was reiterated as a protective measure preventing lateral movement or secondary impacts across the corporate network. No explicit details regarding attacker attribution, specific vulnerabilities exploited, or data exposure were released in the initial update. Ongoing investigations focused on reinforcing application security controls and reviewing access logs to prevent recurrence.

Sources

Sources available to members: 1 source.