Two EY Staffers, 21 & 25, Face Criminal Charges for Accessing PM’s Bank Account

For the legal and regulatory community, the EY incident represents a stark stress test of Australia’s privacy and corporate crime frameworks. As the two men, aged 21 and 25, face court, lawyers will scrutinize the intersection of intent, access privileges, and the duty of care owed by professional services firms. With the precedent of PwC’s downfall still fresh, this case could redefine how liability is apportioned between individual employees and the organizations that enable them.

The revelation that two EY junior staffers allegedly accessed the bank account of Australian Prime Minister Anthony Albanese has sent shockwaves through the corporate and political worlds. The incident, first reported by the Australian Financial Review on June 30, 2026, marks a new low in a series of governance scandals that have engulfed Australia's elite consulting firms. The two men, aged 21 and 25, joined EY in March 2026 and were immediately seconded to Commonwealth Bank of Australia (CBA), the nation's largest lender. While embedded at CBA, they reportedly used their access to view the personal banking details of the prime minister and at least one EY partner. CBA's internal systems detected the unauthorized access, and the bank alerted EY, leading to the swift termination of the staffers. The Australian Federal Police have since charged both individuals with accessing restricted personal banking data belonging to a federal parliamentarian, a criminal offense that could carry severe penalties.

“

The revelation that two EY junior staffers allegedly accessed the bank account of Australian Prime Minister Anthony Albanese has sent shockwaves through the corporate and political worlds.

This breach is not an isolated aberration but part of a troubling pattern of misuse of privileged information within Australia's consulting sector. In recent years, KPMG Australia saw its chair, Martin Sheppard, step down after whistleblower allegations that the firm used confidential client data to win business—a decision announced just last week. Three years ago, PwC's Australian arm was dismantled after it was exposed for leaking confidential government tax policy information to corporate clients. The EY incident, involving access to a sitting prime minister's personal finances, underscores how thin the line has become between professional access and egregious violation of trust. It also raises uncomfortable questions about the due diligence and oversight of young consultants embedded within critical financial institutions.

From a legal perspective, the charges against the individuals are only the tip of the iceberg. The breach likely violates Australia's Privacy Act and possibly the Criminal Code, which prohibits unauthorized access to computer data. The severity of the punishment will depend on whether the access was out of mere curiosity or for some ulterior motive — both men may face prison time. Beyond individual liability, EY and CBA could face regulatory scrutiny from the Australian Securities and Investments Commission (ASIC) and the Office of the Australian Information Commissioner (OAIC). CBA, in particular, may be questioned about its access controls and monitoring systems. As primary custodian of sensitive financial data, the bank could be subject to mandatory data breach notifications and potential class-action lawsuits from affected individuals if broader abuse is discovered.