Two graduate employees have been dismissed and are facing criminal charges after allegedly accessing confidential banking information belonging to Australian Prime Minister Anthony Albanese while working on secondment at Commonwealth Bank.

The incident has renewed attention on data security, internal access controls and privacy obligations within Australia’s financial services sector, where employees and contractors are entrusted with highly sensitive customer information.

According to the Australian Federal Police, the two men, aged 21 and 25, have been charged with allegedly accessing restricted banking information without authorisation while working at Commonwealth Bank. Both were graduate employees of Ernst & Young (EY) who had been seconded to the bank as part of a technology project.

Investigators allege the pair accessed the personal banking details of Prime Minister Anthony Albanese as well as information relating to at least one senior EY partner. Police allege the access occurred by using internal banking systems intended only for legitimate work purposes. The allegations have not been tested in court, and both men are entitled to the presumption of innocence while legal proceedings continue.

The 21-year-old has been charged with unauthorised access to restricted data and with allegedly distributing personal information using a carriage service in a manner authorities say could be regarded as menacing or harassing. The 25-year-old has been charged with one count of unauthorised access to restricted data. Both men are scheduled to appear before Newtown Local Court.

Commonwealth Bank detected the unusual account access through its internal monitoring systems and alerted EY, according to reports. The bank has declined to comment on the specific contractor matter, while noting it would not discuss individual personnel issues publicly. EY has also declined to comment on the allegations but confirmed the two graduates are no longer employed by the firm.

Both EY and Commonwealth Bank require staff and contractors with access to customer information to complete privacy and confidentiality training before being granted access to sensitive systems. Employees are instructed that customer records may only be viewed where there is a legitimate business reason and that curiosity or personal interest is not a valid basis for accessing accounts.

The case has also prompted broader discussion about information security within Australia’s major consulting firms. Recent months have seen several large professional services firms face scrutiny over governance, data handling and internal compliance, leading to reviews of oversight, ethics and risk management practices across the sector.

Privacy experts note that financial institutions typically maintain detailed audit logs recording every access to customer accounts, allowing unusual activity to be identified and investigated. Such monitoring forms part of broader regulatory requirements intended to protect customer information and maintain confidence in Australia’s banking system.

The criminal proceedings against the two former graduates will determine whether the alleged offences are proven. Until the matter is resolved by the courts, the allegations remain unproven, while the incident is expected to remain an important case study in data governance, employee access controls and privacy compliance within the financial services industry.