Latitude Financial says it's received a ransom demand from those allegedly behind the recent cyber attack that exposed customer details.
The company says it won't pay the ransom in line with the position set out by the Australian Government.
"Based on the evidence and advice, there is simply no guarantee that doing so would result in any customer data being destroyed and it would only encourage further extortion attempts on Australian and New Zealand businesses in the future," Latitude CEO Bob Belan said today.
The hack has exposed 1,037,000 New Zealand driver licence numbers, along with passport details and other customer records.
Latitude has operated in New Zealand with its buy-now-pay-later service Genoapay and Gem Visa.
Just over 2000 Kiwibank customers using Latitude have also been caught up in the hack.
Latitude says data detailed as part of the ransom threat is consistent with the numbers thought to be caught up in the recent cyber attack.
"I apologise personally and sincerely for the distress that this cyber attack has caused and I hope that in time we are able to earn back the confidence of our customers," Belan said
The company has not confirmed how much money the hackers are asking for.
Privacy Commissioner wants answers
The New Zealand Privacy Commissioner is still waiting for answers from Latitude Financial over the country’s biggest known cyber attack.
In a statement to 1News, a spokesperson said, "the Privacy Commissioner also wants answers to some key questions."
"These include how the cyber-criminal got in, how they managed to penetrate so far and why so many records have been retained for so long."
However, Latitude Financial’s decision not to pay the requested ransom has been supported by the commissioner’s office.
“Even if companies do pay a ransom there is absolutely no guarantee that the information won’t be shared online or sold on.
“We recommend they (Latitude customers) keep a close eye out for any suspicious activity on their accounts and any platforms they use.”
Customers are being encouraged to work with their banks and telco providers and consider checking their credit record.
People who feel their privacy has been harmed by the breach are also encouraged to make a complaint to the Office of the Privacy Commissioner.
SHARE ME