Has Westpac been the victim of a Cyber Attack? Online banking blocked for overseas customers

This week has been a nightmare for some Westpac customers and their bank is telling them sweet bugger all. Today, Customers overseas are resorting to VPNs to mask their location so they can access online banking – is this all part of the bank’s response to a Cyber Attack?

On Monday Westpac online and app banking suffered an outage around 2pm in the afternoon. It didn’t last too long, and didn’t seem to affect all customers.

Tuesday, and it’s déjà vu – another outage.

From Westpac, all we got was notices that they were aware, they were working on it and later that services had been restored.

Wednesday, still traces of user reported issues and another statement from Westpac

But nothing in their statement suggested some users might still have an issue. Yet, if you look online, you’ll find plenty – even today.

And, those overseas have started to realise, they are the only ones still suffering the issue.

So resorting to buying a VPN and setting their location to Australia seems to be working.

With that in mind, and knowing that Australian users seem to be up and running, what’s going on?

Well, hacktivist group Rippersec has been actively targeting the Bank of Sydney with a Denial of Service attack this week:

So is it drawing too long a bow to suggest that Westpac too might be under some form of Denial of Service (DDoS) attack.

A DDoS is a Cyber Attack not aimed at breaking into systems or stealing data, but overwhelming a system or network to slow traffic and potentially bring services to a halt.

If you were working in a large defensive IT team at a major bank and you were detecting a Denial of Service attack, the smartest thing to do would be to block all traffic from unknown areas.

For example, overseas.

Reports even yesterday about this outage had some people saying they couldn’t access the bank, and suggestions from other users suggested to turn off WiFi – and it worked, using 4G/5G allowed access to the bank online – which indicates the bank is allowing traffic from our mobile networks, but perhaps hasn’t isolated all Aussie ISP’s.

Bottom line, this is all conjecture, but it points to some network restrictions in place at Westpac, and the only reason to do that is defensive.

Is Westpac under Cyber Attack? I don’t know, but I suspect it’s likely.