Tech

Latitude Financial begins notifying customers of data breach – up to 328,000 customers affected

Australia’s biggest non-bank personal finance lender Latitude Financial this morning advised the ASX that it had been the victim of a cyber attack, and this afternoon began contacting customers.

Following the massive Medibank and Optus breaches late last year Latitudes breach is on a similar level of severity while not as extensive in number.

Latitude has almost 3 million customers, so with 10% affected, it’s a massive problem for the company.

Critically, and for me most concerning – Latitude says that 103,000 ID documents were stolen. The concerning thing is they say that 97% of them were “copies of drivers’ licences”. Those words make me feel like they have literal photos or photocopies of drivers’ licences, which means both the Card Number and Licence number would be accessible to the hacker, meaning new drivers licences for 100,000 people.

It appears Latitude doesn’t keep much data of their own – with the original source of the hack happening at a “major vendor used by Latitude”. In that hack, a Latitude employee login credentials were obtained by the hacker.

What’s amazing is that those credentials were then used to steal personal information held by two other service providers. It’s at one of those providers where the 103,000 ID documents were stolen, and at the other 225,000 customer records were stolen.

We have no information about what was in those records.

Latitude this afternoon commenced contacting customers, saying “We’re writing to you directly to update you on a recent cyber-attack that Latitude Financial is actively responding to. Regrettably, the attack has resulted in the theft of some customer data”

“Latitude apologises to its customers, particularly those who were impacted. Please be assured we will contact you directly if your personal information has been disclosed.”

It’s an important first step for Latitude, taking the lead from Medibank’s approach to over communicating with customers, and doing the opposite of what Optus did which was to fail to communicate directly with customers.

The next step needs to be to clarify just what information was obtained by the hackers, and then to let individual customers know in which of the three groups they sit.

  1. Unaffected
  2. ID Document Obtained
  3. Customer Data Obtained

EFTM has asked Latitude the following questions which at this stage seem important to customers:

  1. Will you be offering identity protection services to your customers – if so how?
  2. How is one employee credential able to download so much customer data ?

Recent Posts

  • Tech

Samsung is bringing their massive 115″ Micro RGB TV to Australia in December

First teased at CES earlier this year, Samsung Australia have finally unveiled their plans for…

31 minutes ago
  • Tech

We reviewed the ECOVACS DEEBOT T50 OMNI, launching today on Amazon for $1,299

ECOVACS has today launched the DEEBOT T50 OMNI with impressive features at great value at…

1 hour ago
  • Tech

Soundcore Sleep A30 Earbuds Review: The perfect sleep buds to bring you a good nights sleep

As a shift worker in my day job, sleep is a constant challenge. Finding quiet…

3 hours ago
  • Tech

Does Facebook owe you cash? How to check for your share of $50 Million

The name Cambridge Analytica meant nothing to Australians on Facebook until we found out that…

8 hours ago
  • Tech

Fujifilm Australia announces the new Fujifilm X-T30 III, a compact, mirrorless digital camera for everyone

Fujifilm Australia has announced the launch of the Fujifilm X-T30 III, their latest X-series compact…

4 days ago
  • Tech

Amazon’s smart glasses may be the first of their kind with an actual purpose

Amazon is a company delivering billions and billions of packages every single day, so they…

4 days ago