Latitude turns away new customers as cyber attack persists

Latitude Financial Group informed shareholders on Monday (20 March) that it has engaged leading external cyber security experts, the Australian Cyber Security Centre, the Australian Federal Police, and other relevant government agencies.

The attack on Latitude is now the subject of an investigation by the Australian Federal Police.

The group revealed on 16 March that it had detected unusual activity on its systems that it can now confirm as a sophisticated, well organised, and malicious cyber attack, which remains active.

“Our people are working around the clock to contain the attackers. We have taken the prudent action of isolating some of our technology platforms which means that we are currently not onboarding new customers,” the company said.

“Because the attack remains active, we have taken our platforms offline and are unable to service our customers and merchant partners. We cannot restore this capability immediately; however, we are working to do so gradually over the coming days and ask our customers for their continued patience.”

The restoration of these services is aligned with Latitude’s forensic review. In conjunction with cyber security experts, the lender is continuing its forensic review of IT platforms to identify the full extent of the theft of customer information as a result of the cyber attack.

Latitude confirmed that approximately 330,000 customers and applicants have had their personal information stolen, the vast majority of which were copies of drivers’ licences or drivers’ licence numbers.

Less than 4 per cent were copies of passports or passport numbers and less than 1 per cent were Medicare numbers.

Outgoing chief executive Ahmed Fahour said he sincerely apologised to customers and partners for the distress and inconvenience the criminal act has caused.

“I understand fully the wider concern that this cyber attack has created within the community. Our focus is on protecting the ongoing security of our customers, partners and employees’ personal and identity information, while also doing everything we can to support customers and applicants who have had information stolen, he said.

“While we continue to deliver transactional services, some functionality has been affected resulting in disruption. We are working extremely hard to restore full services to our customers and merchant partners and thank them for their patience and support.”

The non-bank has commenced contacting customers and applicants who have so far been impacted.

Latitude will confirm to each impacted customer and applicant what personal information has been stolen, what it is doing to support them, and what additional steps customers should consider taking to further protect their information.

The company is working with relevant agencies to replace identification documents, where necessary, at no cost to its customers.

It has engaged IDCARE to help support those impacted. IDCARE is a not-for-profit organisation and Australia and New Zealand’s national incident response service specialising in providing free, confidential cyber incident information and assistance. Impacted customers and applicants will be able to contact IDCARE during business hours on 1800 595 160.

[Related: Latitude cyber attack claims 100,000 customer drivers’ licences]