Latitude cyberattack: customer data stolen

The company said “unusual activity” had been detected on its systems in the past few days, “believed to have originated from a major vendor used by Latitude”.

It appears the attacker stole Latitude employee log-in credentials from one technology vendor and used them to log into two other service providers to steal customer files and ID documents.

Latitude shares entered a trading halt just before the incident was announced to the ASX before the market opened on Thursday. The shares will remain in a halt until the extent of the breach becomes clearer.

The breach comes a month before chief executive Ahmed Fahour is due to leave the struggling lender and be replaced by the head of its money unit, Bob Belan.

Latitude said it had taken immediate action once it became aware of the incident, but the attacker was able to obtain Latitude employee login credentials before the incident was isolated.

Latitude said more than 97 per cent of the 103,000 ID documents taken were copies of drivers’ licences and had been stolen from the first service provider. About 225,000 customer records had been stolen from the second service provider.

“Latitude apologises to the impacted customers and is taking immediate steps to contact them.” the lender said in an ASX announcement.

Medibank was felled by a massive cyberattack last year, and Commonwealth Bank said last week its Indonesian subsidiary had been hit by a cyber incident that did not affect customers in Australia.

Latitude is working with the Australian Cyber Security Centre and said it had alerted law enforcement agencies and engaged cyber specialists to help with its response.

“Our priorities are to ensure the ongoing security of our customers, our employees and our partners while continuing to deliver services,” Latitude said, pledging to provide further updates to the ASX.

Archie Reed, research director at tech advisory firm Adapt, said Latitude must provide regular, transparent and constructive communications about its response to the incident, including with customers who would need guidance on how to protect themselves.

“In a cybersecurity sense, financial services providers are among some of the most tightly regulated companies out there. But compliance with the rules doesn’t make you immune from cyberattacks,” he said.

Latitude said in February its full-year profit plunged as its interest costs tripled, weighing heavily on earnings. This forced the lender to slash its final dividend.

Mr Sproules described the cyber incident as an “unfortunate start” to Mr Belan’s tenure as CEO.