Latitude Financial says millions of driver's licence details & details from tens of thousands of passports pilfered in cyber attack

Latitude Financial Services says the cyber attack it's battling has resulted in the theft of about 7.9 million Australian and New Zealand drivers' licence numbers and about 53,000 passport numbers.

Latitude offers personal loans, car loans, credit cards and insurance in NZ under the Gem Finance brand. Its buy now pay later service Genoapay recently stopped accepting new customers. Victims of the cyber attack include Latitude customers, past customers and applicants. Latitude is the former GE consumer finance business.

The Australian stock exchange listed company first disclosed the attack on March 16, saying it had detected unusual activity on its systems over the last few days that appeared to be a sophisticated and malicious cyber-attack. Latitude says the activity is believed to have originated from a major vendor used by Latitude, with the attacker able to obtain Latitude employee login credentials before the incident was isolated. The attacker appears to have used the employee login credentials to steal personal information held by two other service providers, Latitude says.

In an update on Monday Latitude says, to the best of its knowledge, no suspicious activity has been observed in its systems since March 16.

"As our forensic review continues to progress, we have identified that approximately 7.9 million Australian and New Zealand driver licence numbers were stolen, of which approximately 3.2 million, or 40%, were provided to us in the last 10 years," Latitude says.

"In addition, approximately 53,000 passport numbers were stolen. We have also identified less than 100 customers who had a monthly financial statement stolen. We will reimburse our customers who choose to replace their stolen ID document."

"A further approximately 6.1 million records dating back to at least 2005 were also stolen, of which approximately 5.7 million, or 94%, were provided before 2013. These records include some but not all of the following personal information: name, address, telephone, date of birth," says Latitude.

"Latitude maintains insurance policies to cover risks, including cyber-security risks, and we have notified our insurers in respect of this incident. We recognise that today’s announcement will be a distressing development for many of our customers and we apologise unreservedly."

A Latitude Financial NZ spokeswoman says the company is working through the data with the aim of providing a breakdown on the number of NZ victims. Those impacted in NZ will include some borrowers who have personal loans through Kiwibank, which are provided by Latitude.

Latitude says it's writing to all customers, past customers and applicants whose information was compromised outlining details of the information stolen and its plans for remediation.

Internal Affairs has provided this information for New Zealanders whose passport details have been stolen in the attack. Waka Kotahi has provided this information for people whose drivers' licence information has been stolen.

Latitude recommends New Zealanders check their credit record to confirm if their identity has been used to obtain credit without their knowledge. 

“It is hugely disappointing that such a significant number of additional customers and applicants have been affected by this incident. We apologise unreservedly," Latitude Financial CEO Ahmed Fahour says.

“We are committed to working closely with impacted customers and applicants to minimise the risk and disruption to them, including reimbursing the cost if they choose to replace their ID document. We are also committed to a full review of what has occurred."

“We urge all our customers to be vigilant and on the look-out for suspicious behaviour relating to their accounts. We will never contact customers requesting their passwords. We continue to work around the clock to safely restore our operations. We are rectifying platforms impacted in the attack and have implemented additional security monitoring as we return to operations in the coming days," says Fahour.

Latitude says the attack is being investigated by the Australian Federal Police, and it's working with the Australian Cyber Security Centre and its own cyber-security advisers.

Latitude's full statement is here.
And there's much more on cyber crime in this episode of our Of Interest podcast.