What happened
In March 2023 Latitude Financial disclosed a breach affecting around 14 million records across Australia and New Zealand, by its own count — roughly 7.9 million driver licence numbers, around 53,000 passport numbers and financial statements for fewer than 100 customers, plus about 6.1 million older records dating from 2005 [lat-itnews]. These are counts of records as stated by Latitude, not a regulator-confirmed count of individuals. The OAIC and the New Zealand Privacy Commissioner opened a joint investigation, a first for the two regulators [oaic-latitude].
Timeline
- 2023-03 — Latitude disclosed the breach; ~14M records across AU & NZ [lat-itnews].
- 2023-05-10 — OAIC and NZ Privacy Commissioner announced a joint investigation [oaic-latitude].
- 2024-02 — The OAIC accepted a representative complaint on behalf of affected customers [oaic-latitude-2026].
- 2026-09-25 — OAIC update: the investigation is ongoing; no determination has been made [oaic-latitude-2026].
Current status
Under joint regulatory investigation (opened 10 May 2023), which the OAIC said was ongoing as of 25 September 2026. In February 2024 the OAIC also accepted a representative complaint on behalf of affected customers [oaic-latitude-2026]. Figures are as stated by Latitude [lat-itnews].
Why it matters
The scale — and the volume of government identity documents — made it one of the largest breaches on either side of the Tasman, and the trans-Tasman regulatory response set a precedent.