DXC Technology says global network is not compromised following Latitude Financial breach

Quickly after Latitude Monetary revealed it suffered a cyber assault, DXC Know-how quietly printed a be aware on its web site stating its international community and buyer assist networks weren’t compromised.

When Latitude Monetary, which is listed within the Australian Securities Alternate (ASX), first printed in regards to the assault it mentioned the exercise was believed to have “originated from a serious vendor used” by the corporate. In line with Latitude, the attacker obtained login credentials from an worker utilizing it to “steal private data that was held by two different companies suppliers”.

Latitude offers loans, bank cards and insurance coverage in Australia, New Zealand, Canada and Singapore. A few of its companies contains curiosity free instalments for JB Hello-Fi, The Good Guys and David Jones clients when purchasing on-line.

Nothing to see right here

DXC is likely one of the largest IT companies suppliers on this planet and again in 2017, when it launched after the merger of CSC and HPE’s companies division, it revealed {that a} majority of its personnel and half of its clients have been based mostly in Australia.

On 17 March, the corporate printed an unprompted public assertion assuring its community was protected. “DXC is liaising with the Australian Cyber Safety Centre (ACSC), and we’ve got suggested them that our methods are safe and working as regular,” learn the assertion.

“DXC takes the accountability of defending the safety of its clients’ methods and information very significantly.”

This announcement sparked suspicion with the AFR Weekend writing it understands DXC to be considered one of Latitude’s suppliers.

CSO has reached out to DXC Know-how Australia for remark.

Latitude reveals 14 million clients impacted, not 330,000

Ten days after Latitude revealed it had been breached, the corporate discovered that information from 14 million individuals had been accessed, versus the 330,000 it had first believed.

The attacker managed to make use of the stolen worker credential to entry buyer information saved by each companies suppliers earlier than Latitude was capable of isolate the incident.

As of 27 March the corporate is aware of that 7.9 million Australian and New Zealand driver licence numbers have been stolen, of which roughly 3.2 million, or 40%, have been supplied to the corporate within the final 10 years. Roughly 53,000 passport numbers have been stolen, and fewer than 100 clients had a month-to-month monetary assertion stolen.

There have been additionally 6.1 million information relationship again to 2005 that have been accessed together with identify, handle, phone, and date of beginning.

“We’re dedicated to working intently with impacted clients and candidates to minimise the danger and disruption to them, together with reimbursing the fee in the event that they select to interchange their ID doc. We’re additionally dedicated to a full overview of what has occurred,” Latitude CSO Ahmed Fahour mentioned in an announcement.

“We urge all our clients to be vigilant and on the look-out for suspicious behaviour regarding their accounts. We are going to by no means contact clients requesting their passwords.”

Latitude has recommended clients contact Australia’s credit score reporting businesses for a credit score report back to verify for any suspicious exercise and in New Zealand to verify credit score information.

The monetary companies supplier had initially remoted and eliminated entry to some customer-facing and inner methods.

“We proceed to work across the clock to soundly restore our operations. We’re rectifying platforms impacted within the assault and have carried out extra safety monitoring as we return to operations within the coming days,” Fahour mentioned.

Investigation and Federal authorities motion

The incident is underneath investigation by the Australian Federal Police (AFP) and Latitude has reported the incident to the Australian Cyber Safety Centre.

The AFP has expanded Operation Guardian to assist shield Latitude Providers clients. Operation Guardian is a joint initiative with state and territory police  and was arrange in September 2022 to guard greater than 10,000 clients whose private data was unlawfully launched on-line after the Optus information breach. It was additionally prolonged to Medibank Non-public clients.

The AFP additionally mentioned that there isn’t a proof up to now that the private particulars of Latitude Providers clients can be found or being bought on on-line or darkish net boards.

The AFP has not too long ago introduced a restructure in response to a rise in cybercrime, appointing Performing Deputy Commissioner, Crime, Grant Nicholls, who shall be answerable for creating and managing the AFP’s crime and cyber methods and associated coverage points and Assistant Commissioner Scott Lee because the chief of Cyber Command.

The Australian Federal authorities is in search of suggestions from a dialogue paper as a way to put collectively a brand new cybersecurity technique. This contains contemplating that Australia develops a Cyber Safety Act and whether or not additional reform to the Safety of Important Infrastructure Act is required.

Minister for Dwelling Affairs and Cybersecurity Clare O’Neil mentioned in an announcement, “Whereas we’ll by no means cut back this danger of those assaults to zero, how we reply and turn out to be extra resilient as a nation is now extra necessary than ever.”

“This authorities is working to make sure that in future digital identities are exhausting to steal and, if compromised, simple to revive,” she mentioned.