Two former Ernst & Young (EY) graduate employees have been charged after allegedly accessing confidential Commonwealth Bank customer records, including banking information belonging to Prime Minister Anthony Albanese, prompting renewed attention to data security and privacy controls within Australia’s financial sector.
The allegations relate to activity that reportedly occurred while one of the accused was working on secondment at Commonwealth Bank. The matter is now before the courts, and the allegations have not been proven.
According to the Australian Federal Police, two Sydney men aged 21 and 25 have been charged over the alleged unauthorised access of restricted Commonwealth Bank data belonging to a federal parliamentarian. One of the men has also been charged with allegedly using a communications service to distribute personal information. Both men have been granted bail and are scheduled to return to court in August.
Multiple media outlets have identified the parliamentarian as Prime Minister Anthony Albanese. Reports also indicate that at least one senior EY partner’s banking information was allegedly accessed during the same incident. EY confirmed that the employees involved are no longer with the firm but declined further comment because legal proceedings are ongoing. Commonwealth Bank likewise said it would not comment on individual contractor matters.
The investigation began after Commonwealth Bank detected irregular activity through its internal monitoring systems and referred the matter to authorities. Financial institutions routinely maintain audit logs and access controls designed to identify unusual or unauthorised access to sensitive customer information, particularly where contractors or third-party personnel are involved.
Treasurer Jim Chalmers described the alleged breach as “incredibly concerning”, saying privacy protections are important for every Australian regardless of whose information is involved. Prime Minister Anthony Albanese has also described the matter as serious but has largely declined to comment further while the case remains before the courts.
The incident has renewed discussion about data governance across Australia’s major consulting firms and financial institutions. Recent years have seen increased scrutiny of governance and confidentiality practices within several large professional services firms following unrelated controversies involving the handling of confidential information. Observers say the latest allegations highlight the importance of strong access controls, staff oversight and rapid detection systems for organisations handling sensitive customer data.
Because the criminal proceedings are continuing, the allegations will be tested through the court process. No findings of guilt have been made, and the accused remain entitled to the presumption of innocence unless and until a court determines otherwise.
