Log in Request a demo

Significant cyber incident

Latitude Financial data theft, 2023

In March 2023 Latitude Financial, an Australian consumer finance company, told the ASX that attackers had stolen personal data.

In short

In March 2023 Latitude Financial, an Australian consumer finance company, told the ASX that attackers had stolen personal data. Latitude said the attacker obtained employee login credentials and believed the activity began at a major vendor. By 27 March it reported about 7.9 million driver license numbers and 6.1 million further records stolen, roughly 14 million in all, and a joint Australian and New Zealand privacy investigation followed.

Last updated October 2026

What happened

On 16 March 2023 Latitude Financial told the ASX it had detected unusual activity that looked like a sophisticated and malicious cyber-attack. It believed the activity came from a major vendor it used. The attacker had obtained Latitude employee login credentials before the incident was isolated (Latitude ASX announcement, 16 March 2023).

Latitude said the attacker appeared to use those credentials to steal personal data held by two other service providers. The first count was about 103,000 identification documents and about 225,000 customer records. On 22 March Latitude said its review had found further large-scale theft. On 27 March it reported about 7.9 million driver license numbers, about 53,000 passport numbers and about 6.1 million further records dating back to at least 2005 (Latitude ASX announcements).

On 11 April 2023 Latitude said it had received a ransom demand and would not pay. The Australian Federal Police investigated, and the OAIC and the New Zealand Privacy Commissioner opened a joint investigation on 10 May 2023.

Timeline

  1. 16 March 2023

    Latitude tells the ASX of unusual activity on its systems, believed to have originated from a major vendor, and says the attacker obtained employee login credentials.

  2. 16 March 2023

    Latitude notifies the OAIC and the New Zealand Office of the Privacy Commissioner. The Federal Government convenes the National Coordination Mechanism.

  3. 16 March 2023

    Latitude states about 103,000 identification documents and about 225,000 customer records were stolen from two other service providers.

  4. 22 March 2023

    Latitude says further evidence of large-scale information theft has been found and that no compromised data has left its systems since 16 March.

  5. 27 March 2023

    Latitude reports about 7.9 million driver license numbers, about 53,000 passport numbers and about 6.1 million further records stolen, and says the AFP is investigating.

  6. 27 March 2023

    The OAIC says it is making preliminary inquiries and working with other agencies. The Minister for Home Affairs issues a statement.

  7. 11 April 2023

    Latitude says it has received a ransom demand and will not pay.

  8. 10 May 2023

    The OAIC and the New Zealand Privacy Commissioner start a joint investigation of the Latitude group.

  9. 30 June 2023

    Latitude says it had notified the vast majority of directly affected customers by this date.

  10. February 2024

    The OAIC accepts a representative complaint about the breach.

  11. 25 September 2026

    The OAIC page published this date says its investigation continues and it will not comment further until it concludes.

How the attack worked

Latitude’s own statements are the main account. They do not describe the malware or tools used, and no official source opened for this page gives more technical detail.

Entry through a third party

Latitude first said the activity was believed to have originated from a major vendor. Its later statement says the criminals used a compromised credential, obtained via a third party, to access Latitude’s network (Valid Accounts, T1078).

Theft from other providers

The attacker appeared to use employee login credentials to steal personal data held by two other service providers. Latitude said the data had been provided by customers when they enquired about or applied for credit.

Containment

Latitude isolated and removed access to some customer-facing and internal systems. By 22 March it said no compromised data had left its systems since 16 March 2023.

How the attack ran
  1. Vendor activityLatitude believed the activity originated from a major vendor
  2. Get login credentialsThe attacker obtained Latitude employee login credentialsTechnique T1078 (MITRE ATT&CK, opens in a new tab)
  3. Access the networkA compromised credential obtained via a third party was used to access Latitude’s networkTechnique T1078 (MITRE ATT&CK, opens in a new tab)
  4. Steal dataPersonal data held by two other service providers was stolen
  5. ContainLatitude isolated systems and worked with the ACSC

Who says who was behind it

No public attribution. The official sources opened (Latitude statements, OAIC, Home Affairs) name no group, and Latitude said the matter was under investigation by the Australian Federal Police (27 March 2023).

Impact

Latitude reported on 27 March 2023 that about 7.9 million Australian and New Zealand driver license numbers and about 53,000 passport numbers were stolen. It also reported about 6.1 million further records dating back to at least 2005, of which about 5.7 million were provided before 2013. Those two figures add up to roughly 14 million. Fewer than 100 customers had a monthly financial statement stolen. Stolen data could include names, contact details, dates of birth, ID documents, Medicare card details and application financial information. Bank account passwords and card CVC numbers were not compromised. Earlier counts on 16 March were about 103,000 identification documents and about 225,000 customer records. Latitude received a ransom demand and said it would not pay.

Government and regulator response

  • 16 March 2023: Latitude told the ASX, worked with the ACSC, alerted law enforcement, isolated some systems, and notified the OAIC and the New Zealand Privacy Commissioner.
  • 16 March 2023: the Federal Government convened the National Coordination Mechanism. By 27 March it had met five times and set up working groups on the financial sector and identity security.
  • 27 March 2023: the Minister for Home Affairs said no customer should bear the cost of a data breach. The OAIC began preliminary inquiries.
  • 27 March 2023: Latitude said it would reimburse customers who replace a stolen ID document, and engaged IDCARE for support.
  • 11 April 2023: Latitude said it had received a ransom demand and would not pay.
  • 10 May 2023: the OAIC and the New Zealand Privacy Commissioner opened a joint investigation, the first of its kind between the two countries.
  • February 2024: the OAIC accepted a representative complaint. On a page published 25 September 2026 the OAIC said its investigation continues.

Lessons

  1. Third-party access is your access

    Latitude believed the activity began at a vendor, and a credential obtained via a third party reached its network.

  2. Stolen logins need monitoring

    The attacker used employee login credentials, so unusual use of valid accounts is the signal to watch.

  3. Data held by providers counts

    The stolen data sat with two other service providers, so your data map must include suppliers.

  4. Old identity data is a liability

    Records dated back to at least 2005, and the OAIC is examining whether data no longer needed was destroyed or de-identified.

  5. Counts can grow

    The reported scale moved from about 328,000 items on 16 March to about 14 million records by 27 March, so early figures need care.

  6. Decide on ransom early

    Latitude publicly said it would not pay, consistent with the position of the Australian Government.

What to check in your own organization

  1. Vendor logins

    List every vendor and employee login that can reach your network, and require multi-factor authentication.

  2. Credential abuse alerts

    Alert on valid accounts used from new places, at odd hours or in bulk data access.

  3. Provider data inventory

    Record which service providers hold copies of customer ID documents and how long they keep them.

  4. Retention and deletion

    Set and enforce a deletion rule for identity documents and old application data.

  5. Containment steps

    Write down how you would isolate systems and cut vendor access quickly.

  6. Notification plan

    Prepare to notify the OAIC and affected people as soon as possible under the Notifiable Data Breaches scheme.

Questions

When did the Latitude breach become public?

Latitude told the ASX on 16 March 2023.

How did the attackers get in?

Latitude said the activity was believed to originate from a major vendor, and that criminals used a compromised credential obtained via a third party to access its network.

How many records were stolen?

On 27 March 2023 Latitude reported about 7.9 million driver license numbers and about 6.1 million further records, roughly 14 million in total, plus about 53,000 passport numbers.

Did Latitude pay the ransom?

No. On 11 April 2023 Latitude said it would not pay.

Who is investigating?

Latitude said the AFP investigates the crime. The OAIC and the New Zealand Privacy Commissioner opened a joint investigation on 10 May 2023.

Who was behind it?

No public attribution in the official sources opened.

Sources

  1. Cyber Incident, ASX announcement (16 March 2023) Latitude Group Holdings
  2. Cybercrime update, ASX announcement (22 March 2023) Latitude Group Holdings
  3. Cybercrime update, ASX announcement (27 March 2023) Latitude Group Holdings
  4. Cybercrime Update 11 (11 April 2023) Latitude Financial
  5. Latitude Cyber Incident, Statement of Notification Latitude Financial
  6. Statement on Latitude Financial data breach (27 March 2023) Office of the Australian Information Commissioner
  7. Joint Australia-New Zealand investigation into Latitude group (10 May 2023) Office of the Australian Information Commissioner
  8. OAIC's action in relation to the 2023 Latitude Data Breach Office of the Australian Information Commissioner
  9. Latitude Financial, media release (27 March 2023) Minister for Home Affairs

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Data breach

A data breach is an event where someone gets access to information they are not authorized to see, or where authorized users use it for a purpose they were not allowed.

Read more

Glossary term

Multi-factor authentication (MFA)

Multi-factor authentication (MFA) is a way to log in that needs two or more different kinds of proof, such as a password and a code from an authentication app.

Read more