Latitude — Data breach disclosed September 2026

Update to a previously disclosed incident
Not stated
Officially confirmed

What this record states

Latitude has reported a data breach.

The source states that information about members was involved.

No source consulted for this record states when the incident occurred.

People affected: 225,000, stated by the source.

Record overview

Incident date: Not confirmed
Discovery date: Not confirmed
Disclosure date: 25 September 2026
Notification date: Not confirmed
People affected: 225,000, stated by the source
Who was affected: members

Each date is either established by a quoted source or explicitly not confirmed.

Affected people and data

Categories of affected data

Not stated

Notifications and response

Regulators notified

OAIC

Law enforcement notified

Australian Cyber Security Centre

Legal and formal response

commenced an investigation

Technical and organisational remediation

Not stated

Official sources

Regulatory update

OAIC’s action in relation to the 2023 Latitude Data Breach and information to update and assist individuals | OAIC

oaic.gov.auRetrieved 25 September 2026

View official source

Further official sources

Corroborating report

Latitude Financial breach impacts 225,000 customers - iTnews

itnews.com.auRetrieved 25 September 2026

View official source

Cleverer commentary

This section is commentary by Cleverer, not reporting, and is not drawn from the sources cited above.

Cleverer Insight

The record concerns OAIC action relating to Latitude’s 2023 data breach. It establishes that the OAIC commenced an investigation on 10 May 2023 into the personal information handling practices of the Latitude group of companies. The record also refers to a representative complaint concerning a group of people with the same concerns about the same act or practice.

The incident and discovery dates, affected number, data categories, notification date and remediation measures are not publicly established in this record. It therefore does not establish the breach’s precise mechanism, scope or impact. The case illustrates the regulatory and representative-complaint dimensions that may follow a personal information handling incident, rather than providing a complete account of the underlying failure.

How Cleverer may have helped

For this kind of failure, current records of preparation, privacy and security controls, training, policies, approvals, incident decisions and communications may help an organisation explain what was in place and how it responded. Clear evidence of oversight and documented actions could make it easier to support regulatory enquiries and address affected individuals’ concerns.

Such records would not, by themselves, establish that the incident was necessarily preventable or that any regulatory outcome would have been avoided. None of this would necessarily have prevented the incident.