Contact Us

We permit responsible vulnerability research on AustralianSuper systems, services and/or products to which you have authorised access. However, we ask that you do not conduct directly or indirectly, any of the following activities, each of which is strictly prohibited:

• Activities that will affect the availability or performance of AustralianSuper systems, services and/or products including any attempts to execute a Denial of Service (DoS) attack or any other forms of cyber-attack;
• Unauthorised access to AustralianSuper accounts or data;
• Any activity that will compromise the confidentiality, integrity and availability of AustralianSuper data;
• Unauthorised transmission, exfiltration, modification or destruction of AustralianSuper data;
• Distribution of unsolicited emails (spam), or any other unauthorised forms of electronic communication to and from AustralianSuper;
• All forms of social engineering (including phishing) of AustralianSuper employees, contractors, members or any other party;
• Any activity that will compromise the physical security of AustralianSuper infrastructure, including property and data centres;
• Post, transmit, upload, link to, send or store all forms of malicious software that could impact our systems, services, products, members, users and/or any other party;
• Unauthorised testing of third-party websites, applications or services that are integrated with our systems, services or products;
• Unauthorised connection and use of hacking technology that will compromise the security of AustralianSuper systems, products and/or services.
• Any activity that contravenes our Terms of Use of AustralianSuper products or services;
• Activity that violates any laws or regulations.

You can responsibly disclose the potential or actual security vulnerabilities to the AustralianSuper Information Security Team by emailing to vulnerability@australiansuper.com

In your report, please include as much information as possible, including:

• When the vulnerability was identified (date, time and the relevant time zone);
• Location of the vulnerability (e.g. URL, domain, IP address; Source IP etc);
• Description of the vulnerability and security issue;
• The affected system, application, product or service;
• Instructions to reproduce the vulnerability;
• Evidence of the findings, which may include screenshots, proof of concepts, video, etc;
• Your contact information.

Once you have reported a potential security vulnerability or issue to us, we’ll acknowledge your submitted report and contact you with an initial response, as soon as possible.

We ask that you maintain confidentiality and do not make your research public without express written consent from us. This will enable us to complete our investigation and, if necessary, have remediated the potential security vulnerability.

We also ask that you delete all data retrieved during your research as soon as it is no longer required or when the vulnerability has been resolved or as otherwise required by law.

Please note that we do not compensate individuals or organisations for identifying potential or confirmed security vulnerabilities. Any requests for monetary or other compensation will be deemed in violation of this statement and our Policies.