Latitude’s woes continue as firm hit with $1 million lawsuit over data breach

Latitude’s woes could become even costlier after being hit with a $1 million lawsuit by a former mayoral candidate who says the firm’s negligence meant his personal details were shared on the dark web.

The firm was hit by a cyber attack in March after a hacker used privileged credentials from a third-party vendor to access its systems and steal the data of 7.9 million customers.

Shahriar “Sean” Saffari was one of the people affected by the hack and is now pursuing Latitude Financial Services Australia for $1 million in damages in a Federal Court case filed earlier this month.

According to documents filed with the court, Saffari held a Low Rate Latitude Mastercard Credit Card. He had his personal information stolen in the data breach and provided to the dark web where other parties could use it for financial gain.

Saffari, who was an unsuccessful independent candidate for Maitland’s mayoralty in 2021, claims the firm failed to take reasonable steps to protect and secure his data, breaching both his privacy and its duty of care to protect him from harm.

Justice Melissa Perry is overseeing the lawsuit which has yet to come before the court.

Latitude has already set aside $46 million because of the data breach, mostly for customer remediation costs.

The firm could also be slammed with future penalties due to regulatory action.

A joint investigation by the Office of the Australian Information Commissioner and the New Zealand Office of the Privacy Commissioner into the data breach is ongoing.

If serious breaches are found, the OAIC can seek fines of up to $50 million per contravention in the Federal Court.

The attack is also under investigation by the Australian Federal Police with Latitude previously saying it was co-operating with the authorities.

The hacker stole driver’s licence numbers; personal details such as names, addresses, telephone numbers, and dates of birth; and income and expense information for 900,000 loan applications, including bank and credit card account details.

But the stolen accounts did not include bank passwords or credit card expiry dates or card verification codes (CVCs).

Latitude is the largest non-bank consumer finance company in Australia, offering unsecured personal loans, car loans and credit cards domestically and in New Zealand.

This article was first published by AAP.