Latitude Financial Vows to Not Pay Ransom After Data Breach

Last month, Latitude Group Holdings, an Australian consumer finance company, faced a massive cyberattack that resulted in criminals obtaining 14 million customer records, which included driver's licenses, passports, and financial statements. The cybercriminals have since demanded ransom, but the company is refusing to pay.

The Australian financial lender recently posted a Cybercrime Update on their website, confirming that the firm has received a ransom demand from the criminals responsible for the cyberattack on the company.

It also confirms that they will not pay the ransom, stating that: “We will not reward criminal behaviour, nor do we believe that paying a ransom will result in the return or destruction of the stolen information. In line with advice from cybercrime experts, Latitude strongly believes that paying a ransom will be detrimental to our customers and cause harm to the broader community by encouraging further criminal attacks.”

The Australian Federal Police are investigating the matter, with Latitude Financial working closely alongside the Australian Cyber Security Centre and cybersecurity experts to address the situation. Latitude is actively reaching out to all affected customers, former customers, and applicants to inform them about the compromised information, the support being offered, and their remediation plans.

The cyberattack involves the theft of 7.9 million driver's license numbers from Australia and New Zealand, along with 53,000 passport numbers. Additionally, 6.1 million customer records were stolen, with 5.7 million of these submitted before 2013. Cybersecurity professionals consider these stolen documents highly sensitive due to their unique identifiers. These identifiers could lead to identity theft when paired with readily available general information about an individual.

The Latitude breach also brings to light concerns regarding data storage practices, seeing as many of the stolen customer records are over 10 years old.

This incident follows a string of significant data breaches in Australia, including those at Optus and Medibank, prompting the Australian Government to intensify its cybersecurity initiatives.