Latitude Finance (GEM Visa) - Data Breach (March 2023)

Please note this sub-forum does not provide professional finance advice. You should seek advice from a licensed financial advisor.

To post in this sub-forum you must have made 100 posts or have Trust status or have completed our ID Verification.

If investing please consider our affiliate link for new accounts: Sharesies.

Forums › Finance and wealth management › Latitude Finance (GEM Visa) - Data Breach (March 2023)

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8

1511 posts

Uber Geek

Lifetime subscriber

#3055906 28-Mar-2023 16:47

Benoire:

Have they released the method to claim for the license replacement?

Not sure, I think they've only contacted people they know had their details obtained so far.

However, based on the latest update I would assume that everyone's details were obtained, but I'm not waiting.. $38 is a small cost to prevent potential identity theft.

wellygary

8312 posts

Uber Geek

#3055908 28-Mar-2023 16:52

Holy #@$@#$@#%#@%$#@!!!!!!!!!!!!!!!!!!

NZTA need to temporality suspend all online transactions that only need a Name and Drivers license NOW....

"1News can reveal that more than 1 million past and present New Zealand drivers licences have been exposed as part of the Latitude Financial hack."

https://www.1news.co.nz/2023/03/28/over-1-million-nz-driver-licence-numbers-caught-up-in-latitude-hack/

Loismustdye

927 posts

Ultimate Geek

Trusted

#3057372 1-Apr-2023 09:05

Just received an email confirming my license details were nicked as part of this. Guess I’m off to the AA to get a replacement license on Monday.

stick

357 posts

Ultimate Geek

#3057377 1-Apr-2023 09:43

Loismustdye:

Just received an email confirming my license details were nicked as part of this. Guess I’m off to the AA to get a replacement license on Monday.

Same here for my Dad. The email said his licence number was stolen. But, on the latitude page, it says

"If we have notified you that your driver licence number has been compromised (but have not notified you that the image of your driver licence has been compromised), you need not replace your licence."

So... I'm guessing he doesn't need to get a replacement license?

Also, @michaelmurfy my dad's phone number was taken in the breach too so maybe that's why he was getting those scam calls? Or a coincidence...

richms

28168 posts

Uber Geek

Trusted

Lifetime subscriber

#3057437 1-Apr-2023 13:54

Got an email about 12:30 today saying that my license number and details I gave when I applied were taken. Not too worried about the details since they're all over the place, but guess I should kick off getting a new license since they will pay me back for it. Wonder what I should invoice for the time tho.

Richard rich.ms

Loismustdye

927 posts

Ultimate Geek

Trusted

#3057600 1-Apr-2023 16:31

stick:

Loismustdye:

Just received an email confirming my license details were nicked as part of this. Guess I’m off to the AA to get a replacement license on Monday.

Same here for my Dad. The email said his licence number was stolen. But, on the latitude page, it says

"If we have notified you that your driver licence number has been compromised (but have not notified you that the image of your driver licence has been compromised), you need not replace your licence."

So... I'm guessing he doesn't need to get a replacement license?

Also, @michaelmurfy my dad's phone number was taken in the breach too so maybe that's why he was getting those scam calls? Or a coincidence...

wonder how that rationale works? Surely if they have your license details then they have the license number etc that could still be used elsewhere.

Admittedly it was a license and details from 15 or so years ago.

the spam calls I pretty much ignore (as I’m a stinge and have turned the answer phone off on my cell)

cokemaster

Exited
4927 posts

Uber Geek

Retired Mod

Trusted

Lifetime subscriber

#3057602 1-Apr-2023 16:35

Agreed. If it’s an active license and the license number/expiry/version number is in the wild… surely a new license is in order.

webhosting

Loose lips may sink ships - Be smart - Don't post internal/commercially sensitive or confidential information!

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

nic.wise

333 posts

Ultimate Geek

Trusted

#3057707 1-Apr-2023 17:19

So yeah, I'm a lattitude customer by having a gem visa for buying apple stuff.

No idea which form of ID sent them, or if it's gone - I only got the initial "we had an incident" email, nothing after that.

Might splurge the $40 to get a new DL anyway. Comms for those _presumably_ not affected has been kinda non-existant.

Definitely making me think about some of our processes and data retention at work.

Nic Wise - fastchicken.co.nz

richms

28168 posts

Uber Geek

Trusted

Lifetime subscriber

#3057712 1-Apr-2023 17:28

Trying to use my card on amazon and its not working. No way to contact them online anymore, resorted to calling them and its just a crappy hold music loop with the odd apology about taking so long after listening to over a minutes worth of crap about the breech, doing things online, that they will record the call and other guff.

Richard rich.ms

stick

357 posts

Ultimate Geek

#3057721 1-Apr-2023 18:05

richms:
Trying to use my card on amazon and its not working. No way to contact them online anymore, resorted to calling them and its just a crappy hold music loop with the odd apology about taking so long after listening to over a minutes worth of crap about the breech, doing things online, that they will record the call and other guff.

My Dad placed an order on Wednesday on Amazon Australia and it was fine. Card had already been added to his account previously

Distorter

220 posts

Master Geek

#3057814 2-Apr-2023 13:07

I wonder if Harvey's will ditch Gem Visa after all this mess as they push and promote them quite a lot and would be a reason for most having one right?

Loismustdye

927 posts

Ultimate Geek

Trusted

#3057825 2-Apr-2023 14:07

Distorter: I wonder if Harvey's will ditch Gem Visa after all this mess as they push and promote them quite a lot and would be a reason for most having one right?

their TV ads certainly aren’t pushing the interest free deals like they used to

Kyanar

4089 posts

Uber Geek

ID Verified

Trusted

#3057945 2-Apr-2023 22:05

Great timing on Latitude's part - about a month after the Australian Government amended the Privacy Act to introduce penalties for "serious or repeated breach of privacy" of $50 million dollars, or 3% of turnover during the relevant period, whichever is the greater.

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#3058444 3-Apr-2023 14:33

From Privacy Commision:

Over one million past and present New Zealand drivers’ licences have been exposed as part of the attack on Latitude Finance, as well as people’s passports. Some of the 14 million New Zealand and Australia records taken are up to 18 years old, which isn’t okay.

Liz MacPherson, New Zealand’s Deputy Privacy Commissioner says that data retention is emerging as a key issue in several recent domestic and global cyber-attacks including the Latitude Finance breach.

“Data retention is the sleeping giant of data security. There are consequences for holding onto data you no longer need. All businesses and organisations can learn from this: don’t collect or hold onto information you don’t need. The risk is simply too high for your customers and your organisation. Don’t risk being a hostage to people who make it their day job to illegally extract data.”

There is no place for a “she’ll be right” attitude to privacy and cyber security. Cyber attackers are active. People are employed to be cyber attackers.

“People make their fortunes from hacking the security of agencies. Having sea borders does not protect your very internet-connected agency from being hacked.

“A key finding from the NZ Institute of Directors’ Director Sentiment Survey report, released late last year, was that a significant proportion of boards were not sufficiently prepared for a digital future and had an “it won’t happen to us” approach. The message from the Office of the Privacy Commissioner is “wake up to yourselves”. We talk to organisations almost every week who are counting the cost of a cyber data breach. Can you risk the impact to your customers and you reputation?”

Agencies should not be collecting or retaining personal information unless it is necessary for a lawful purpose connected with their function or activity. All agencies should have a personal information retention schedule that they review regularly. The simple discipline of deciding how long information will be retained as you collect it and acting on these decisions will save you and your customers a lot of pain.

The Office of the Privacy Commissioner also encourages individuals to challenge hard why an agency needs to collect and retain their personal information.

“If ID is being used as means of verification, ask why it needs to be collected or copied rather than simply sighted and recorded. If your information is being collected, ask how long it will be kept for and why. The more people challenge, the more likely it is that organisations will change their behaviour.”

Privacy needs to become a core business issue, as important as health and safety.

About the Latitude Finance privacy breach

The Latitude Financial cyber-attack involves New Zealanders and Australians so both privacy regulators for each nation are working together.

“We will share each other’s preliminary inquiries as we seek to understand what happened and establish our next steps. This includes the potential for coordinated investigations and joint regulatory action”, says Deputy Privacy Commissioner Liz MacPherson.

The Office was first notified of the breach on March 16. Since then, the size and scale of the data theft has grown dramatically as Latitude has undertaken forensic analysis of their systems.

The combined total of Australian and New Zealand records is now 14 million, including 6.1 million records that are over 10 years old. Some records are at least 18 years old.

“We are continuing to engage with Latitude Financial and our Australian counterparts to understand the nature, causes and consequences of the breach. Unfortunately, the true scale of cyber-security breaches can take some time to be revealed,” says Liz.

The Office is currently focussed on the impact of the attack on individual members of the public. But the Privacy Commissioner also wants answers to some key questions. These include how the cyber-criminal got in, how they managed to penetrate so far and why so many records have been retained for so long.

Latitude Financial is progressively contacting all affected customers who have had their personal data stolen to tell them what has been stolen and how Latitude will assist them.

People who have been contacted directly by Latitude and told what has been stolen should work with Latitude Financial first to try to get a resolution. “It is Latitude Financial’s responsibility to put things right. It is important that affected customers give Latitude a chance to make good on their commitments to provide support. However, if after people have worked with Latitude their privacy harms have not been resolved to their satisfaction, we encourage them people to make a complaint to our Office.”

For both impacted Latitude customers and those who have not yet been told whether their data is impacted the message is to be hyper vigilant.

“Keep a close eye on your accounts for any unusual activity. Work with your banks and telco providers and consider checking your credit record”.

We encourage you to make use of the free expert ID protection advice being provided through IDCare.

MikeAqua

7773 posts

Uber Geek

#3058446 3-Apr-2023 14:42

A class action is being contemplated. We are affected by the breach and have reached out to the legal firm mentioned. I wouldn't expect a lot of compensation, but a painful court proceeding might serve as a salutary lesson for data holders.

Kiwis urged to join possible Latitude legal action over data hack (1news.co.nz)

Mike

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8