Spirit Super

Spirit Super is an Australian superannuation fund that provides retirement savings and investment products to its members, operating within the regulatory framework governing Australian superannuation. The fund offers a range of investment options, insurance coverage, and member services designed to help individuals accumulate and manage their retirement benefits over their working lives. As a financial services entity, Spirit Super is subject to oversight by Australian prudential regulators and must comply with strict data protection and privacy obligations. Its headquarters are located in Australia, reflecting its primary market focus on Australian residents seeking retirement solutions. The organisation’s core mission centres on delivering financial security for members through prudent investment management and member‑focused support.

On 19 May 2022, a staff email account at Spirit Super was compromised through a phishing attack, granting unauthorized access to a mailbox containing personal member information. The breached data primarily resembled annual statement details, including names, addresses, ages, contact information, account numbers, and balances, while a limited subset also included more sensitive documents such as identification records, tax file numbers, bank details, and birthdates. Upon discovering the incident, Spirit Super swiftly contained the breach, launched an investigation to determine the scope and impacted individuals, and prioritised outreach to those members whose higher‑risk data had been exposed. The organisation communicated with affected members, offered guidance on protective steps, and worked to reinforce its email security controls to prevent similar incidents. This event highlighted the importance of robust phishing defences and vigilant data protection practices within the superannuation sector.