Prime Minister Anthony Albanese has called for accountability following criminal charges over the alleged unauthorised access of confidential Commonwealth Bank customer information, saying Australians expect their personal financial data to be protected.

Speaking after details of the case became public, Albanese said those responsible should be held to account if the allegations are proven through the legal process. He described the matter as serious while declining to comment extensively because court proceedings are now underway.

The case centres on allegations that two former Ernst & Young (EY) graduate employees improperly accessed confidential Commonwealth Bank customer records while working on secondment at the bank. According to the Australian Federal Police, the alleged conduct included access to banking information connected with the Prime Minister and other customers. The allegations have not been proven and remain before the courts.

Investigators have stated that the matter involved alleged unauthorised access by individuals with workplace system access rather than an external cyberattack or data breach affecting the bank’s wider technology infrastructure. Commonwealth Bank said its internal monitoring systems identified unusual account access activity and referred the matter to law enforcement authorities for investigation.

EY confirmed that the two individuals named in the proceedings are no longer employed by the firm. The company has stated that it is cooperating with relevant authorities while declining to comment further because of the ongoing criminal proceedings.

The case has prompted renewed discussion about privacy protections within Australia’s financial sector. Banks and organisations that handle sensitive customer information typically rely on access controls, audit logs and continuous monitoring systems designed to detect unusual account activity and reduce the risk of unauthorised access by employees or contractors.

Privacy specialists note that insider access cases differ from external cyberattacks because authorised users already possess system credentials. For that reason, financial institutions generally use additional monitoring tools to identify unusual viewing patterns, excessive account searches and other activity that falls outside normal business requirements.

Government ministers have emphasised that Australians should have confidence that allegations of this nature are investigated thoroughly and independently. Any findings regarding the accused will ultimately be determined through the judicial process, with both defendants entitled to the presumption of innocence unless found guilty by a court.

The investigation continues under the supervision of law enforcement authorities, while the criminal proceedings are expected to examine the allegations in detail during future court hearings. Until that process concludes, the allegations remain matters before the court rather than established facts.