Latitude has moved to isolate key technology systems and has temporarily ceased onboarding new customers following a major hack, disclosed last Thursday, of systems containing its customers’ personally identifiable data.

“Because the attack remains active, we have taken our platforms offline and are unable to service our customers and merchant partners,” Latitude said in a statement.

The company added: “We cannot restore this capability immediately, however we are working to do so gradually over the coming days and ask our customers for their continued patience. Our restoration of these services is aligned to our forensic review.”

A full forensic review of IT platforms is currently underway “to identify the full extent of the theft of customer information”.

Latitude last Thursday revealed it was the victim of a “sophisticated and malicious” cyber-attack, with the company noting at the time that around 330,000 customer records (including more than 100,000 ID documents) were nabbed by criminal hackers.

Approximately 96 per cent of PII data stolen was copies of drivers’ licences or driver licence numbers, with the rest made up of copies of passports, passport numbers and Medicare numbers.

It is suspected that the attacker used employee login credentials to steal personal information held on third-party service provider servers.

Latitude said it is likely to uncover more stolen information affecting both current and past Latitude customers and applicants, as its review deepens to include non-customer originating platforms and historical customer information.

The company said it has commenced contacting customers and applicants directly affected by the breach.

“Latitude will confirm to each impacted customer and applicant what personal information has been stolen, what we are doing to support them and what additional steps customers should consider taking to further protect their information.”

The financial services group added that it is working with relevant agencies to replace identification documents, where necessary.

“Once the cyber-attack is contained, Latitude commits to a review of this incident. This review will help Latitude to most effectively safeguard our customers, partners and platforms, while contributing to the continued fight against cyber-crime on Australian businesses.”

Latitude said it has engaged external cyber-security experts, the Australian Cyber Security Centre (ACSC), the Australian Federal Police (AFP) and other relevant Government agencies after identifying the breach.

The attack is now also the subject of an investigation by the AFP.

Latitude services around 2.8 million customer accounts, with more than 5,500 merchant partners in Australia and New Zealand and 5,800 accredited brokers throughout Australia.