Credit: Latitude Financial Services
Latitude Financial Services has claimed over 300,000 records have been stolen in a cyber attack stemming from an unnamed “major vendor”.
The intrusion, which has been described by the company as a “sophisticated and malicious cyber attack” in a statement published on the Australian Securities Exchange (ASX), began as an unspecified incident originating at the unnamed vendor.
This then allowed the attacker to obtain Latitude employee login credentials before the incident could be isolated.
By allegedly using the credentials, Latitude claims the attacker stole personal information held by two service providers.
Of the over 300,000 records compromised, 103,000 were allegedly stolen from one service provider, with over 97 per cent of these being driver's licenses. Meanwhile, approximately 225,000 records were allegedly stolen from the second provider.
“Latitude is continuing to respond to this attack and is doing everything in its power to contain the incident and prevent the theft of further customer data, including isolating and removing access to some customer-facing and internal systems,” the ASX statement read.
“We are working with the Australian Cyber Security Centre, have alerted relevant law enforcement agencies and engaged several cyber security specialists to assist with Latitude’s response.
“Latitude will cooperate with authorities to investigate this attack. Our priorities are to ensure the ongoing security of our customers, our employees and our partners while continuing to deliver services.”
This is the latest high-profile data breach by an Australian company, coming months after incidents at Medibank in October and Optus in September.
