The shares of both IPH Ltd (ASX: IPH) and Latitude Group Holdings Ltd (ASX: LFS) are under pressure after cyber incidents.
Last year, we saw difficult cyber incidents at both Optus and Medibank Private Limited (ASX: MPL).
IPH cyber attack
The IPH share price is down around 10% after the company said that on 13 March 2023, the IP law business detected unauthorised access to a portion of its IT ‘environment’.
IPH is working with “leading external cyber security and forensic IT advisors” to respond and conduct a forensic investigation. This “may take some time to complete.”
The company said this is “primarily limited to the document management systems of the IPH head office and two IPH member firms.
The information contained in the document management systems include documents relating to the administration of those entities. For Spruson & Ferguson and Griffith Hack, it also related to client documents and correspondence, as well practice management systems (PMSs), which contain case management information (such as filing timelines).
It has transitioned to alternative processes which are “working adequately to enable the relevant firms to continue to conduct operations, albeit with some disruption.”
Latitude cyber incident
The ASX financial share said it has “detected unusual activity on its systems” over the last few days that appears to be a “sophisticated and malicious cyber attack.”
This activity is “believed to have originated from a major vendor.”
According to Latitude, the attacker was able to “obtain Latitude employee login credentials before the incident was isolated.”
The attacker “appears to have used the employee login credentials to steal personal information that was held by two other service providers.”
Latitude understands that of approximately 103,000 identification documents, “more than 97% of which are copies of drivers’ licences, were stolen from the first service provider. Approximately 225,000 customers records were also stolen from the second service provider.”
It said that it’s doing everything in its power to contain the incident and prevent the theft of further customer data.
