Incident: Commonwealth Bank Online Banking Outages Impacting Customers Nationwide

Published Date: 2021-07-05

Postmortem Analysis
Timeline 1. The software failure incident happened in June 2021. [117212]
System 1. Commonwealth Bank's online banking system [117212] 2. CommBank's mobile phone apps [117212] 3. ATMs (less affected) [117212] 4. Osko/PayID transfers [117212]
Responsible Organization 1. Akamai Technologies - The software failure incident was caused by United States based content delivery company Akamai Technologies' infrastructure temporarily failing, which affected Commonwealth Bank and other entities [117212].
Impacted Organization 1. Commonwealth Bank customers [Article 117212] 2. Bendigo Bank customers [Article 117212]
Software Causes 1. The software failure incidents were caused by repeated major outages in the Commonwealth Bank's online banking system, affecting services such as netbanking and EFTPOS payments [117212]. 2. The June 17 outage was caused by a system outage that affected Commonwealth Bank and other banks, airlines, and Australia Post due to the temporary failure of United States-based content delivery company Akamai Technologies' infrastructure [117212].
Non-software Causes 1. Overload or capacity issues leading to system outages [117212] 2. Infrastructure failure of a content delivery company (Akamai Technologies) [117212]
Impacts 1. Customers were unable to log online, access their balance, or make payments, causing inconvenience and frustration [117212]. 2. Some users reported not being able to buy lunch or transfer money to pay bills, leading to personal financial difficulties [117212]. 3. The repeated software failures led to a loss of trust and confidence in the bank's online banking services, with customers expressing anger and considering switching banks [117212]. 4. Other banks, such as Bendigo Bank, also experienced online banking issues, impacting a wider range of customers [117212]. 5. The software failure incidents occurred multiple times within a short period, indicating a recurring problem that affected various services and industries [117212].
Preventions 1. Implementing robust testing procedures: Conducting thorough testing, including stress testing and load testing, could have helped identify potential issues before they impacted customers [117212]. 2. Enhancing redundancy and failover mechanisms: Having redundant systems in place and effective failover mechanisms could have minimized the impact of the outage and allowed for quicker recovery [117212]. 3. Regularly monitoring and updating infrastructure: Ensuring that the bank's infrastructure, including servers and networks, is regularly monitored and updated could help prevent unexpected failures [117212]. 4. Collaborating with third-party service providers: Working closely with third-party service providers, such as content delivery networks, to ensure their systems are robust and reliable could prevent cascading failures like the one caused by Akamai Technologies' infrastructure issue [117212].
Fixes 1. Implementing more robust testing procedures to catch potential issues before they impact customers [117212]. 2. Enhancing the bank's online infrastructure to improve stability and reliability [117212]. 3. Collaborating with third-party service providers like Akamai Technologies to ensure their systems are resilient and can handle high traffic loads without failing [117212].
References 1. User reports on Twitter [117212] 2. downdetector.com.au [117212] 3. Statements from Commonwealth Bank [117212] 4. Statements from Bendigo Bank [117212]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident has happened again at one_organization: - The Commonwealth Bank experienced its fourth major lunchtime outage in a month, with previous outages occurring on July 2, June 23, and April 26 [117212]. - Customers expressed frustration over the repeated problems with the bank's online banking services, indicating a pattern of recurring software failures within the same organization [117212]. (b) The software failure incident has happened again at multiple_organization: - The June 17 system outage that affected Commonwealth Bank was not isolated to just the bank but also impacted other banks, airlines, and Australia Post due to a temporary failure in Akamai Technologies' infrastructure [117212]. - Bendigo Bank customers also reported online issues around the same time as the Commonwealth Bank's incident, suggesting a broader impact on multiple organizations [117212].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the article where it mentions that the chaos and outages experienced by Commonwealth Bank customers were caused by a system outage that affected not only the bank but also other banks, airlines, and Australia Post. This disruption was attributed to the infrastructure of United States-based content delivery company Akamai Technologies failing, impacting various services [117212]. (b) The software failure incident related to the operation phase is evident in the same article when users reported issues with netbanking and EFTPOS payments, indicating operational difficulties in accessing and using the bank's services. Additionally, the article highlights how customers were unable to log in, access their balances, make payments, and experienced delays in transfers, all pointing towards operational challenges faced by users [117212].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident at Commonwealth Bank, leading to customers being unable to log online, was primarily due to issues within the bank's system. Users reported problems with netbanking and EFTPOS payments, indicating internal system failures [117212]. Additionally, the bank's mobile phone apps and ATMs were less affected, further suggesting that the core online banking system was the primary source of the issue. (b) outside_system: The software failure incident at Commonwealth Bank was also influenced by factors originating from outside the system. For example, a previous crash on June 17 was caused by the temporary failure of United States-based content delivery company Akamai Technologies' infrastructure, affecting not only Commonwealth Bank but also other banks, airlines, and Australia Post [117212]. This external factor impacted the bank's ability to provide online services to its customers.
Nature (Human/Non-human) non-human_actions (a) The software failure incident in the Commonwealth Bank case was primarily due to non-human actions. The outage was caused by a crash affecting CBA customers on July 2 and another at lunchtime on June 23, which was just days after another previous crash that also took down other banks. These crashes were attributed to a system outage caused by United States-based content delivery company Akamai Technologies' infrastructure temporarily failing [117212].
Dimension (Hardware/Software) software (a) The software failure incident reported in the articles seems to be primarily due to software issues rather than hardware. The incidents mentioned include online banking outages, problems with netbanking and EFTPOS payments, issues with accessing balances and making payments, and delays in transfers. These issues point towards software-related problems within the Commonwealth Bank's systems [117212].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident reported in the articles appears to be non-malicious in nature. The incidents were mainly attributed to technical issues and system outages affecting Commonwealth Bank and Bendigo Bank's online banking services. Users reported problems accessing their balances, making payments, and experiencing disruptions in services like netbanking and EFTPOS payments [117212]. The failures were not described as intentional or caused by malicious actors but rather as technical glitches and system failures.
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident reported in the articles seems to be related to poor_decisions. The incidents of outages and online banking issues at Commonwealth Bank were a result of repeated failures in their online services, affecting customers' ability to access their accounts, make payments, and use netbanking and EFTPOS services. Customers expressed frustration and anger over the repeated problems, indicating a lack of effective decision-making or actions taken by the bank to address and prevent such failures [117212].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the repeated major outages experienced by Commonwealth Bank customers. Users expressed frustration and anger over the continuous issues with the bank's online banking system, indicating a lack of professional competence in maintaining a stable and reliable service [117212]. (b) The accidental nature of the software failure incident is highlighted in the article where a crash affecting CBA customers on July 2 was attributed to a system outage caused by the temporary failure of United States-based content delivery company Akamai Technologies' infrastructure. This incident was not intentional but rather a result of an accidental failure in the external service provider's infrastructure [117212].
Duration temporary (a) The software failure incident described in the articles is temporary. The incidents mentioned in the news articles highlight temporary outages experienced by Commonwealth Bank customers, with issues such as being unable to log in, access balances, make payments, and use online banking services. The bank acknowledged the problems, apologized to customers, and assured them that they were urgently investigating the issues to provide a resolution soon. Customers expressed frustration over the repeated problems they have been facing with the bank's online services, indicating that the failures were not permanent but rather intermittent and recurring [117212].
Behaviour crash, omission, other (a) crash: The software failure incident in the articles is characterized by crashes, where the system loses its state and fails to perform its intended functions. Customers of Commonwealth Bank reported being unable to log in online, access their balance, make payments, or conduct transfers due to the crashes [117212]. (b) omission: The incident also involved omissions, where the system omitted to perform its intended functions at instances. Users reported not being able to buy lunch, transfer money to pay bills, or make Osko/PayID transfers due to the system failures [117212]. (c) timing: There is no specific mention of timing-related failures in the articles. (d) value: The software failure incident did not involve the system performing its intended functions incorrectly. (e) byzantine: The incident did not exhibit behaviors of the system behaving erroneously with inconsistent responses and interactions. (f) other: The other behavior observed in the software failure incident is the repeated nature of the outages, with customers expressing frustration over the frequent crashes and issues with the bank's online banking services [117212].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, delay, theoretical_consequence (a) unknown (b) unknown (c) unknown (d) Customers were unable to access their balance or make payments, impacting their financial transactions [117212]. (e) Customers had to postpone activities such as buying lunch and transferring money to pay bills due to the software failure [117212]. (f) unknown (g) Customers experienced inconvenience and frustration due to the repeated outages, but there were no reported severe consequences such as death or physical harm [117212]. (h) Theoretical consequences were discussed by customers threatening to switch banks if the issues persisted [117212]. (i) unknown
Domain finance (a) The failed system in the incident was related to the finance industry, specifically affecting Commonwealth Bank customers' online banking services [117212]. The outage impacted services such as netbanking and EFTPOS payments, causing users nationwide to experience difficulties accessing their accounts and making transactions. (h) The software failure incident directly impacted the finance industry, as Commonwealth Bank customers were unable to log in online, access their balances, or make payments due to the outage [117212]. The bank's mobile phone apps and ATMs were also affected to a lesser extent, highlighting the widespread disruption within the financial services sector. (m) The software failure incident does not relate to an industry outside of the options provided.

Sources

Back to List