Australia’s banking sector is facing renewed attention after two former Ernst & Young (EY) graduate employees were charged over the alleged unauthorised access of confidential customer banking information while working on secondment at Commonwealth Bank (CBA).
The case has generated widespread discussion about internal access controls, contractor oversight and the safeguards financial institutions use to protect sensitive customer information.
According to the Australian Federal Police (AFP), two Sydney men aged 21 and 25 have been charged with allegedly accessing restricted banking data belonging to a federal parliamentarian without authorisation. Multiple Australian media outlets have identified the parliamentarian as Prime Minister Anthony Albanese. The allegations have not been tested in court, and both men are entitled to the presumption of innocence while legal proceedings continue.
Investigators allege the two men were employed as graduate staff by EY and had been seconded to Commonwealth Bank to work on a technology project. Reports indicate they allegedly confirmed through the bank’s internal systems that they were authorised to access confidential customer information before viewing the banking records. Authorities allege one of the accused also distributed personal data, leading to an additional criminal charge.
Commonwealth Bank has declined to comment on the specific contractor matter because the case is before the courts. EY has likewise declined to discuss the allegations in detail but confirmed the two individuals are no longer employed by the firm. Both organisations require employees and contractors with access to sensitive banking systems to complete privacy and confidentiality training before receiving system access.
Australian Treasurer Jim Chalmers described the reported incident as “incredibly concerning”, adding that every Australian expects personal banking information to remain secure regardless of whether the customer is a public official or a private citizen. He declined to comment further on the legal proceedings because the matter is now before the courts.
The incident has also renewed discussion about internal data governance within Australia’s major consulting firms. Large professional services firms frequently second employees to banks, government agencies and major corporations, making robust access controls, audit logging and staff training essential components of information security programs. Industry experts note that financial institutions routinely monitor access logs to identify unusual account activity and investigate any potential misuse.
Privacy specialists say modern banking systems generally record every customer record accessed, allowing compliance teams to identify unusual behaviour and determine whether access was connected to legitimate business activities. Such monitoring helps institutions detect potential misuse while supporting regulatory obligations relating to customer privacy and information security.
The criminal proceedings will ultimately determine whether the alleged offences are proven. Until then, the allegations remain before the court. Regardless of the legal outcome, the case has highlighted the importance of strict internal controls, employee accountability and continuous monitoring of sensitive customer information within Australia’s financial sector.
