Back to the archive
Incident file · 2023
Latitude Financial
Consumer finance · Australia · Threat actor: Unattributed
Credential stuffing
Ransom refused
- Undisclosed
- Ransom demanded
- No
- Ransom paid
- 12 days
- Estimated downtime
- US$50m
- Est. revenue lost
What happened
Stolen employee credentials were used to pivot into two service providers, exposing driver licence and passport numbers.
How it ended
Publicly refused to pay the ransom, suspended new originations for nearly two weeks and booked A$76m in costs.
Data affected
14 million records
Would your business survive this incident?
We stress-test detection, response and recovery so a ransom demand is never your only option.