Update, October 2026: The OAIC’s investigation into Latitude, opened on 10 May 2023, was still in progress at its 25 September 2026 statement, and in February 2024 the OAIC accepted a representative complaint about the breach. That statement explains that people affected by the breach are likely to be members of the class covered by the complaint.
Shahriar Sean Saffari, an unsuccessful mayoral candidate in Australia, has initiated legal proceedings against a prominent financial services firm, accusing them of inadequate protection of customer information. Saffari seeks compensation amounting to $1 million as a result of the emotional distress he experienced following the data breach.
Latitude’s Cyber Attack and the Compromised Customer Data
In March, Latitude fell victim to a cyber attack that resulted in the unauthorized access and theft of data including about 7.9 million driver’s license numbers. During the incident, a suspected hacker group gained control of the company’s servers by exploiting a compromised employee account. This breach of security ultimately led to the filing of the lawsuit.
Identity Theft and Financial Consequences of the Breach
Saffari, as a victim of the data breach, expressed concerns over the potential consequences of the attack. Losing his Master Credit Card details, he feared that the stolen information could be used for identity theft and unauthorized access to his personal accounts, potentially resulting in financial loss.
Justice Melissa Perry Overseeing the Case and Financial Provision for Affected Customers
Justice Melissa Perry has been assigned the task of overseeing the case and ensuring its resolution. Meanwhile, Latitude Financial Services has booked a $46 million provision for costs associated with the cyber incident.
Collaborative Investigation by Privacy Commissioner and Information Commissioner
The New Zealand Office of the Privacy Commissioner and the Office of the Australian Information Commissioner (OAIC) are jointly conducting an investigation into the data breach. The findings of this investigation are expected to be concluded by September. If substantial breaches are discovered, the OAIC can apply to the court for a civil penalty order or make a determination against the company.
Correction, 26 October 2026: this article said data of 7.9 million customers was stolen, that Latitude had set aside $46 million as compensation to be paid to claimants, and that fines would be passed to customers as loan discounts; the 7.9 million figure is driver’s license numbers, the $46 million was a provision for costs associated with the incident, and no source supports the claim about discounts.