Past and present customers of Latitude Financial are being urged to register for possible class action, as the scope of the cyber attack becomes clearer.
Two Australian legal firms are looking to get in touch with New Zealanders caught up in the significant hack, which has exposed 1,037,000 New Zealand driver licence numbers, along with passport details and other customer records.
Latitude has operated in New Zealand with its buy-now-pay-later service Genoapay and Gem Visa.
Just over 2000 Kiwibank customers using Latitude have also been caught up.
James Naughton, commercial law partner at Gordon Legal, told 1News that all customers could be eligible to participate in legal action.
"If the (Australian) Privacy Commissioner finds breaches of the privacy laws, they can make orders that Latitude would need to comply with, including audits for compensation," he said.
"Those audits for compensation can include for direct economic loss, (whether) someone's directly harmed but also emotional distress or emotional harm as well."
Naughton said participating in any class action would be free for affected customers.
"If a class action is issued in the future, then it's likely that a class action would be under a cost regime where the group members don't have to pay and their things will need to work out as our investigation goes forward."
The law firm is also looking to whether Latitude Financial has been playing down the potential threat to customers whose data has been exposed and will be investigating why the company was holding onto data from as far back as 2005.
"Under the Australian privacy principles, companies have got an obligation to remove or delete data that is old that they no longer need, or at least de-identify it," he said.
"One of the things we're really going to be focusing on is whether Latitude complied with its legal obligations in relation to that."
The incident also includes passports, the number of which is still unknown. (Source: 1News)
The initial investigation is expected to take a few weeks, with customers encouraged to register at latitudedatabreach.com.au.
SHARE ME