Information icon

CPIplus is available now for retirees. Want more certainty over your returns test? Click here

Join

Anthony page

Our products and services

Learn about super

Manage your super

We’re an award-winning industry super fund

Our measure of success is what we deliver for our members. But if you're into awards, we've got those too.

Compare Hostplus

Past performance is not a reliable indicator of future performance and should never be the sole factor considered when selecting a superannuation fund.

Retirement

Forms and resources

We’re an award-winning industry super fund

Our measure of success is what we deliver for our members. But if you're into awards, we've got those too.

Compare Hostplus

Past performance is not a reliable indicator of future performance and should never be the sole factor considered when selecting a superannuation fund.

Why choose Hostplus

canva-farmer-man

Make Hostplus the fund of choice for your business

Understand what you need to do to meet your obligations as an employer.

Learn more

Past performance is not a reliable indicator of future performance and should never be the sole factor considered when selecting a superannuation fund.

Your responsibilities

How to make payments

Tools and resources

Why Hostplus

Product and fee information for advisers

Tools and resources

News and insights

Investment options

Manage your super anywhere. That’s a Plus+

Download the Hostplus app.

Get the app

Pricing and performance

Tools and resources

News & insights

Retired and looking for more certainty over your returns?

Introducing CPIplus, a Pension investment option that aims to deliver a consistent and predetermined return above inflation each year.

Test Button

Not available for Transition to Retirement Pensions.
Though returns above inflation are predetermined annually, Hostplus can shorten the return period. Hostplus may also adjust the rate of return with at least 30 days’ notice. 

Join
  1. Home
  2. Members

HWL Ebsworth
Cyber Security Incident 

Protecting your personal information

This page contains information for members impacted by the HWLE data breach including advice about how to add additional security to your account, frequently asked questions, and useful resources.  The vast majority of Hostplus members are not impacted by this incident. 

HWL Ebsworth (HWLE) experienced a cyber-attack earlier this year. This attack involved unauthorised access to a portion of HWLE's IT environment and the theft of data.

Hostplus, who engage HWLE as a third-party legal services provider, has been advised that some personal information relating to Hostplus members has been compromised.

Hostplus’ own systems have not been impacted by this incident and member accounts remain safe and secure.

HWLE and Hostplus continue to work together to address any impacts and ensure support is available to affected members. 

Hostplus has also taken steps to mitigate the risk of any unauthorised access by placing additional identification controls on member accounts to help prevent against identity theft. 

A specialist team has been set up to respond to any enquiries or concerns from Hostplus members relating to the HWLE breach. They can be contacted on 1300 348 546.  

Yes, Hostplus’ own systems have not been impacted by this incident and member accounts remain safe and secure. 

Hostplus have also worked to secure your personal and financial information in a variety of ways.  

We have specific preventative and monitoring controls in place, including:  

  • additional identification verification points through our customer-facing teams 
  • enhanced security monitoring
  • engagement with law enforcement and regulators wherever needed. 

Hostplus also safeguards your information using multi-factor authentication.

When accessing your account online, you must enter a one-time PIN. You'll need this one-time PIN to log in to your Member Online, Pension Online and your account via the Hostplus app, or phone. 

Multi-factor authentication is effective in protecting against unauthorised access to your information and accounts. 

Further information on this important security feature can be found here. 

There are steps you can take to make your account even more secure and for peace of mind. These include  keeping your contact details with us up to date so we can get in touch with you quickly if we suspect any unusual activity on your account. 

We also recommend you:  

  • Always keep your security codes, PINs and passwords private. 
  • Do not provide remote access to your computer or device to unknown parties who may use this access to try to steal your information. 
  • Remain alert to increased scam activity, especially email and SMS or telephone phishing scams (ie fraudulent communications disguised as if to look like they come from an organisation you trust, including Hostplus).
  • Be on the lookout for emails and texts that you're not expecting. Hover over a link to check for misspelt web domain names and unusual sender email addresses. They can contain links that can damage your security. 
  • Consider using a long, unpredictable and unique passphrase instead of passwords and enable multi-factor authentication on other online accounts where possible. Australian Cyber Security Centre guidelines can be found here. 
  • Enable up-to-date anti-virus or similar security protections on any device you use to access your online accounts.  
  • Stay up to date with what is happening with your Hostplus account. You can do this by downloading the Hostplus mobile app and enabling mobile app and email notifications. Read all correspondence from Hostplus, including notification alerts and your annual statement. 

HWLE has partnered with IDCARE, Australia’s national identity and cyber support community service, specifically for the purpose of providing impacted individuals with tailored and specific advice, beyond the general advice that is ordinarily available to members of the public. 

IDCARE have expert Case Managers who can work with you in addressing concerns in relation to personal information risks and any instances where you think you information may have been misused.  IDCARE’s services are at no cost to you. 

If you wish to speak with one of IDCARE's expert Case Managers please complete an online Get Help form at idcare.org or call 1800 595 160. 
Note IDCARE specialist Case Managers are available from 9am-6pm AEDT Monday to Friday excluding public holidays.  

When engaging IDCARE please use the referral code HWLEBS23.

If you have any questions about the incident, you can contact HWLE directly at hwlecyberhelp@hwle.com.au 

If you have any questions relating to your Hostplus member account, contact us on 1300 348 546 and quote your member number. 

Further information on online safety, cyber security and helpful tips to protect yourself and respond to scams, identity theft and other online risks, can be found at the following government agency websites:

Have the authorities been notified?

HWLE has reported the incident to, and continues to work closely with, the Australian Cyber Security Centre (ACSC), the Office of the Australian Information Commissioner (OAIC) as well as relevant government agencies and law enforcement authorities, including the Australian Taxation Office.

Why did it take so long for someone to contact me?

Hostplus recognise the importance of notifying members as soon as possible when a potential data breach occurs. 

When such incidents occur in relation to third party providers, we work to ensure that accurate and timely information is provided to impacted members as a priority. In this case, the large volume of data that was extracted in relation to the HWLE breach meant a complex manual review process was needed to identify who was impacted. This information enabled affected persons and any relevant information to be identified enabling notification to occur. 

Notification of affected individuals therefore was undertaken as soon as reasonably possible when the necessary information became available.

As the organisation that directly experienced the breach, HWLE is responsible for notifying impacted parties and coordinating the appropriate response. Hostplus is working directly with HWLE and other stakeholders to support this response and ensure it meets the expectations of our members. 

What kind of personal information has been taken?

Member information including your name, address, member number, mobile number and/or email, may have been compromised in the breach. 

Are funds in my account at risk?

No, Hostplus’ systems were not compromised in the HWLE cyber-attack and the security of your funds is not at risk.

The fund has comprehensive controls in place to protect member accounts so that they cannot be accessed by unauthorised persons.  

If Hostplus’ systems weren’t directly compromised, why would I need to add additional security to my account?

As the HWLE breach involved personal information, we have added additional security measures so that members can be confident that their accounts with Hostplus remain safe and secure. 

This forms part of a multifaceted response to this incident by HWLE and Hostplus. 

Why did you give my data to a law firm?

Hostplus recognise the importance of upholding the privacy and confidentiality of all member information and are obligated to do so by law. 

We deliver our services in accordance with the Privacy Act 1988 and the Australian Privacy Principles. 

Our Privacy Policy is available to all members via the member portal and on our website. This information would have also been provided to you when you became a member of the fund. 

As outlined in our Privacy Policy, we are sometimes required to disclose relevant personal information to third party organisations that help us provide services, this includes but is not limited to the fund administrator, insurers, legal advisors and auditors. We limit the information provided to these organisations to what they need to perform their services for us or to provide products or services to you. These organisations are also bound by strict confidentiality arrangements. 

I know someone else with Hostplus but they didn’t receive a letter, were they also impacted?

If the member has not received contact from HWLE, it is unlikely that they have been affected. 

The HWLE data breach only impacted a small number of Hostplus members.