Perpetual was recently made aware of an IT security incident on a system provided by a third-party provider which supports a range of administration services to some of our funds.

The incident was the result of unauthorised access to the third-party's system. Upon being notified of the incident, Perpetual disconnected from the third party’s system and immediately engaged external forensic IT experts to urgently investigate whether any client information had been accessed. As a result, we experienced an extended outage to some of our online services. This outage was necessary and precautionary to prevent any spread to Perpetual’s systems, which remain safe and secure. Core systems have now been restored and processing client transactions and payment of withdrawals has re-commenced, however access to myPerpetual remains impacted. We recognise the importance of the end-of-financial year timeframe, and we will continue to keep you informed.  

Importantly, our investigations have not identified any impact to any Perpetual client investments or superannuation accounts, which remain safe and, that sensitive client data remains secure. This includes any identification documents which may have been provided to us.

As part of this investigation, we have become aware that some personal information was accessed from the third-party system.

There is no impact to Perpetual's listed products, institutional mandates, Pendal, Perpetual Corporate Trust, Perpetual Wrap clients or any of our international asset management businesses.

Yes. All client investments are safe and secure. They are held in custody by an independent global custodian not related to the impacted registry providers system. All our own systems remain safe and secure.

Our current investigations have identified that sensitive client data remains secure and encrypted, including any identification documents which may have been provided to us.

Unfortunately, it is reasonable to conclude that a limited amount of personal information has been compromised. This includes:

• Contact details (first names, surnames and addresses); and
• In some instances, bank account details which are not linked to the contact details above.

Given the ongoing and increasing threat of cyber security events, we are taking proactive steps to inform all of our clients.

Yes. Clients should use their existing Client ID and Passwords to login - these were not affected in the security incident. The first time you access myPerpetual, you will be required to change your password to continue.  

Our investigation has found two separate and unrelated files which may have been compromised. A file containing first names, surnames and addresses and a second separate file containing bank account details which are unlinked to names and addresses, meaning that it is difficult to match these bank account details with names and addresses that appear in the first file.

All client investments are held in custody by a separate independent global custodian not related to the impacted unit registry provider’s system. Likewise, all Perpetual internal systems used for trading are completely separate from the impacted unit registry provider’s system.

The registry provider performs administration services to some of our funds such as annual statement generation, recording investor/member transactions and maintaining a registrar of the investor/member holdings in the Funds. The registry provider maintains investor/member data to provide these types of services. It is the unit registry system provided by the third party that has experienced an IT security incident.

Given the ongoing and increasing threat of cyber security events, we are in the process of informing all of our clients and encourage clients to be vigilant in relation to any increased scam activity.

We acknowledge that these types of incidents may potentially increase the risk of identity theft or fraud. While bank account details alone cannot be used to access bank accounts, we still recommend you carefully monitor any transactions for any unusual activity and change your passwords regularly.

We also recommend you remain alert to any increased scam activity, especially through email, text messages and telephone calls and do not respond to, open or click on links in emails or text messages if you are unsure about the sender.

Further guidance on how to protect your identity is also available on the Office of the Australian Information Commissioner (OAIC’s) website as well as the ACCC’s scamwatch website.

Both Perpetual and our third-party unit registry provider have appointed external forensic experts, both of which are highly experienced in situations of this nature.

The incident was the result of unauthorised access to the registry provider’s system. All our own systems remain safe and secure.

We have a high level of confidence that sensitive client data remains secure and encrypted. As part of the restoration of our services, we have worked with our third party provider to ensure the operational environment is safe and secure.

The majority of our investigations are now complete. We will continue to work with our third-party provider and external forensic investigators until the issue has been fully resolved.

Perpetual places the highest priority on the privacy and security of our clients’ information. The incident was the result of unauthorised access to the registry provider’s system. All our own systems, remain safe and secure.

We regularly review third-party providers to ensure their processes and controls either meet or exceed industry standards.

We annually audit the design and effectiveness of key IT controls at the provider relating to security, availability, confidentiality and privacy. 

As part of the restoration work currently underway we have taken extra steps check and verify that systems are protected and safe in a new environment.

Our Client Services team are available to help. Please contact 1800 022 033 if you have any questions or concerns.

If you normally transact using myPerpetual and wish to access information about your account or transacting, please refer to our guide here.