Mercer Super has notified members that its post office box in Melbourne’s CBD has suffered a “security breach” that could have led to the theft of letters that include people’s personal and financial information.

In an alert to members, it said anyone who had posted mail to the box from July 1 to July 17, and who hadn’t received a response within the normal time frame, could be exposed.

Mercer said members should be alert for suspicious emails, calls and texts, nor should they share personal or financial information unless they are sure of the source. It said it had “implemented additional controls to minimise the risk of fraudulent activity”, but did not specify what.

Mercer has notified the regulator APRA, and Australia Post has said it is investigating the incident.

“Australia Post is supporting a Victoria Police investigation into after-hours break-ins at the Melbourne GPO Box Room,” Australia Post said in a statement.

“We have implemented a range of additional security measures following the break-ins, including after-hours security presence at this site. Australia Post takes these matters incredibly seriously and we apologise for the inconvenience caused.”