Generation Life breach through an external service provider exposes some clients' personal information
Australian investment provider Generation Life was breached via an external service provider. It confirmed a limited, unquantified number of people's personal information was affected; funds and transactions were not. Ignore unexpected contact; verify via [email protected].
If you are a Generation Life client, treat unexpected emails, calls or texts claiming to be from the company with caution. Check them by emailing [email protected] or calling 1300 420 229, and respond to any notification letter you receive.
What’s happening
Generation Life, an Australian investment provider owned by Generation Development Group, disclosed on 27 April 2026 that an unauthorised party had accessed part of its systems through an external service provider. It said it detected and contained the incident quickly and notified APRA, the ACSC, the OAIC and the National Office of Cyber Security. On 17 May it said a third party had posted online claiming to hold some of its data; Cyber Daily reported that the Qilin ransomware gang listed the company in May, though the listing showed no data at the time. On 24 June Generation Life said its investigation had confirmed personal information of a limited number of individuals was affected, and that it was notifying them. It has not said how many people, or what types of data. It says core investment systems were not accessed, client funds and investments were unaffected, no unauthorised transactions were found, and services run normally. The service provider has not been named in the sources read. As of the latest statement found, 24 June 2026, no later update has been located.
- What
- Breach
- Affects
- Generation Life (Australian investment and insurance bonds provider)
- Fixed in
- Nothing to patch
- Since
- 27 Apr 2026
- Closed
- 26 June 2026
Timeline
- Update
Cyber Daily reported the confirmation that customers were affected. It said no exact number was given, the types of data were not specified, and the service provider was still not named.
- Update
After its investigation, Generation Life said it was notifying individuals whose personal information was confirmed as affected, describing them as a limited number. It repeated that investment systems, client funds and transactions were unaffected.
- Wider attacks
Generation Life said a third party had posted online, naming it and claiming to have accessed some of its data. Forensic specialists were assessing the claim. Cyber Daily later reported the Qilin ransomware gang listed Generation Life on its leak site in May, with no data or sample shown on the listing at the time of writing.
- Update
Cyber Daily reported the customer letter and a related ASX disclosure by parent Generation Development Group. At that point no group had claimed the attack and the service provider was not named.
- Made publicNothing to patch
Generation Life told clients that an unauthorised party had reached part of its systems through an external service provider. It said it detected and contained the incident quickly, found no access to core investment systems and no unauthorised transactions, and had notified APRA, the ACSC, the OAIC and the National Office of Cyber Security.
Sources
- Important update (27 April 2026)Generation Life · 27 Apr 2026
- Important update (17 May 2026)Generation Life · 17 May 2026
- Important update (24 June 2026)Generation Life · 24 June 2026
- Generation Life informs customers of cyber incident as owner shares incident with ASXCyber Daily · 28 Apr 2026
- Generation Life confirms customers impacted in April cyber incidentCyber Daily · 26 June 2026