A Cyber Attack Resulted in the Theft of Latitude’s Customer Data
- Written by Ari Denial Cybersecurity & Tech Writer
Latitude has fallen victim to a “sophisticated and malicious” cyberattack, which has led to the theft of approximately 1,03,000 identification documents and 2,25,000 customer records.
Following a cyberattack, Latitude Financial Services (aka Latitude) has revealed a data breach, which has forced the company to close down both internal and customer-facing systems.
As the largest non-bank consumer credit lender in Australia, Latitude is a significant provider of personal loans in the country.
Latitude, a subsidiary of Deutsche Bank and KKR, offers a wide range of consumer finance services such as unsecured personal loans, credit cards, car loans, personal insurance, and interest-free retail finance.
According to Citi analyst Brendan Sproules, the cyberattack could result in short-term expenses ranging from $10 million to $15 million as Latitude takes steps to safeguard customer identities and enlist the services of expert advisors. However, any costs incurred may be offset by cyber insurance policies in place.
The data breach has occurred just a month before the scheduled departure of CEO Ahmed Fahour. He will be succeeded by Bob Belan, the current head of the money unit. This presents an additional challenge for the already struggling lender.
Latitude has reported that over 97% of the 1,03,000 stolen ID documents were duplicates of driver’s licenses taken from the first service provider, while the second service provider had approximately 2,25,000 customer records stolen.
As part of its response to the incident, Latitude has closed down various internal and customer-facing systems, and is continuing to work on containing the attack and preventing any additional breaches or theft of customer data.
In an ASX announcement, Latitude expressed its apologies to the affected customers and stated that it is taking prompt action to reach out to them.
“Latitude’s priorities are to ensure the continued security of our customers, employees, and partners while also maintaining service delivery,” the company stated, promising to provide further updates to the ASX.
Data Allegedly Stolen From US Marshals Service Ransomware Attack Up for Sale
- Written by Ari Denial Cybersecurity & Tech Writer
On a hacking forum in the Russian language, a threat actor is reportedly selling hundreds of gigabytes of data that they claim to have stolen from servers of the US Marshals Service (USMS).
The threat actor is claiming to have 350 GB of confidential law enforcement data from the US Marshal Service. A newly registered account has allegedly posted the offer for sale at a price of $1,50,000.
The data being offered reportedly contains aerial footage and photographs of military installations and other highly secure areas, as well as copies of passports and identification documents. Additionally, it allegedly includes information on wiretapping and surveillance of citizens.
According to the threat actor, the files being sold also contain information on convicts, gang leaders, and cartels. The data is allegedly marked as SECRET or TOP SECRET in some cases.
Drew J. Wade, a spokesperson for USMS, has confirmed that a major ransomware attack took place on February 17th, and that sensitive data was stolen. The stolen data reportedly included returns from legal processes, administrative information, and information pertaining to USMS investigations.
Although the hacker selling the data has claimed that they possess details of individuals under the witness protection program, the US Marshal Service has stated that the threat actor was unable to access this information.
USMS spokesperson Drew Wade has confirmed that the stolen data in this incident, which has been categorized as a “major incident,” contains personally identifiable information of USMS employees.
Sources close to the incident have informed NBC News that the attackers were unable to access the Witness Security Files Information System (WITSEC), also known as the witness protection program, database belonging to USMS.
USMS had reported another data breach in May 2020, where details of over 3,87,000 current and former inmates were exposed. The incident, which took place in December 2019, reportedly disclosed their names, home addresses, dates of birth, and social security numbers.
