Superannuation funds must urgently implement basic user authentication tools within a matter of months after the prudential regulator said a cyberattack on the sector, where criminals stole hundreds of thousands of dollars from retirees, exposed persistent weaknesses in their infrastructure.

Australian Prudential Regulation Authority deputy chairwoman Margaret Cole said the $4.2 trillion sector had fallen short of the expected standards on cybersecurity despite regular reminders to get their houses in order.