Latitude says March cyber attack may result in £55.14m in mitigation costs

Australian digital payments company Latitude Group Holdings says it expects to incur up to AUD 105 million (£55.14 million) in costs due to a significant cyber security incident it suffered earlier this year.

Latitude said in March that suffered a significant data breach on March 16th that compromised the drivers’ licences and customer records of around 328,000 customers. The company later revised the number of affected customers to as many as 14 million following an investigation.

The company said in a filing with the Australian Stock Exchange on April 11th that it received a ransom demand but decided not to pay a ransom to the threat actors.

“Latitude Financial (ASX: LFS) has received a ransom demand from the criminals behind the cyber attack on our company. The stolen data the attackers have detailed as part of their ransom threat is consistent with the number of affected customers disclosed by Latitude in our announcement dated 27 March 2023.

“Latitude will not pay a ransom to criminals. Based on the evidence and advice, there is simply no guarantee that doing so would result in any customer data being destroyed. It would only encourage further extortion attempts on Australian and New Zealand businesses in the future,” said Latitude Financial CEO Bob Belan.

In a recent filing with the Australian Stock Exchange, the company said it expects to incur after-tax losses between AUD 95 million and AUD 105 million due to the cyber security incident. 

 

This amount, however, doesn’t include potential costs associated with regulatory fines, class actions, future system enhancements, or an assumption of insurance proceeds.

“As a consequence of the direct impacts of the cyber-attack on operations, IFRS 9 credit provisions, and the provision for costs and remediation, the 1H23 Statutory Loss after tax from continuing operations is forecast to be in the range of $95m to $105m, with the full year statutory result also expected to be a loss.

“Due to the forecast statutory after-tax loss, it is unlikely that Latitude will declare a dividend for the six months to 30 June 2023,” the company said.