The 2023 Latitude Financial breach exposed the personal information of around 14 million customers, including a large number of driver licence numbers and other identity documents, making it one of Australia’s largest breaches. The attackers reportedly gained access using stolen employee credentials, and Latitude refused to pay the ransom demanded.
What happened
In early 2023, Latitude Financial, an Australian financial services and lending company, disclosed a major data breach. The scale was enormous: the personal information of around 14 million customers was affected, a figure that placed it among the largest breaches in Australian history, coming not long after the Optus and Medibank incidents that had already put data security at the centre of national attention.
For Australians, the Latitude breach reinforced a difficult reality: large organisations holding their personal and identity information were being breached at scale, and the consequences were serious and lasting. It became another defining example of the harm a major breach can cause, and of how much personal data Australian companies hold.
The entry point: stolen employee credentials
The breach reportedly began with stolen employee credentials. Attackers are understood to have obtained login details belonging to Latitude staff, then used that access to reach systems and data, including data held by third parties Latitude worked with. From that foothold, they were able to access and exfiltrate a vast amount of customer information.
This is a familiar and important pattern. As with many major breaches, the way in was not a sophisticated technical exploit but a stolen credential, a valid login in the wrong hands. It underscores, again, that protecting credentials, and adding multi-factor authentication so a stolen password alone is not enough, is one of the most important defences against exactly this kind of large-scale breach.
What was exposed
The exposed data was extensive and, critically, included identity document information. Reports indicated that a very large number of driver licence numbers were exposed, along with other personal information and identity document details for millions of customers. This is what made the breach so serious: it reached into the documents people use to prove who they are.
As with the Optus breach, the exposure of identity document details is especially harmful, because these details cannot simply be reset. A driver licence number is tied to a document people rely on for years, and its exposure creates a lasting risk of identity theft and fraud. For millions of affected Australians, the breach created a practical and stressful problem of protecting and, where necessary, replacing compromised identity documents.
Why identity document exposure is so serious
The exposure of identity documents at this scale is the heart of the harm. Most breaches expose data that can eventually be changed, a password reset, a card reissued. Identity document details are different. Your driver licence number does not change because it was exposed. The information remains valid and valuable to criminals long after the breach, which is why breaches involving identity documents cause such lasting concern.
Criminals use exposed identity details for identity theft and fraud, combining them with other stolen information to impersonate victims. The larger the pool of exposed identity documents, the more material criminals have to work with. This is why the exposure of millions of Australians’ identity document details, across the Latitude, Optus and other breaches, has been treated as a serious national issue, and why affected individuals need to remain vigilant well after the incident.
The refusal to pay the ransom
A notable aspect of the Latitude breach was the response to the ransom demand. The attackers reportedly demanded a ransom, and Latitude declined to pay it. This reflected a position, encouraged by authorities, that paying ransoms funds and encourages further crime and offers no guarantee that stolen data will be protected or deleted.
Refusing to pay is a difficult decision, because it means accepting the risk that stolen data may be misused or published. But paying carries its own serious problems, including no assurance of any benefit and the funding of criminal activity. The Latitude case became part of a broader conversation in Australia about how organisations should respond to ransom demands, and about the reality that paying is never a reliable solution.
The lessons and why monitoring matters
The Latitude breach carries clear lessons. Protecting credentials is essential, since stolen credentials were the reported entry point, and multi-factor authentication is a critical defence. The sensitivity of identity document data means it warrants the strongest protection. And the scale of the breach, following Optus and Medibank, underscored that Australian organisations hold vast amounts of personal data and must protect it accordingly.
For the millions affected, and for organisations holding sensitive data, monitoring for exposure is part of the response. Because exposed identity details cannot be reset, knowing when they surface, so affected people can protect themselves and replace documents where advised, matters. DarkThreatX monitors Tor, Telegram and I2P, along with forums and marketplaces, tracking more than 100 billion records with alerts in under five minutes when exposed data appears. No single source has full coverage of the dark web, and DarkThreatX maintains broad Telegram monitoring across these networks.
To watch for exposure in the financial sector or of your own data, explore dark web monitoring for financial services or personal dark web monitoring.
For a detailed account, see reputable reporting on the Latitude Financial breach.
Frequently asked questions
How many people were affected by the Latitude breach?
The 2023 Latitude Financial breach affected around 14 million customers, making it one of the largest data breaches in Australian history, coming after the Optus and Medibank incidents.
How did the Latitude breach happen?
It reportedly began with stolen employee credentials. Attackers used those login details to reach systems and data, including information held by third parties, then exfiltrated a vast amount of customer data. The entry point was a valid credential, not a sophisticated exploit.
What was exposed in the Latitude breach?
Extensive personal information, including a very large number of driver licence numbers and other identity document details for millions of customers. The exposure of identity documents is especially serious because, unlike a password, these details cannot simply be reset.
Did Latitude pay the ransom?
No. Latitude reportedly declined to pay the ransom demanded, consistent with the position that paying funds and encourages further crime and offers no guarantee that stolen data will be protected. It became part of a broader Australian conversation about responding to ransom demands.
