Digital payments and lending firm Latitude Group Holdings Ltd has admitted a hacker has stolen the personal information of up to 15 million customers - in one of the most significant hacks of an Australian company this year. 
Latitude provides consumer finance services to Harvey Norman, JB Hi-Fi, The Good Guys, Apple and recently signed up David Jones, and operates a buy now, pay later service called LatitudePay.
The data, which was stolen on 16 March, includes the driver licence numbers of 7.9 million Australian and New Zealand customers.
Up to 15 million Latitude customers have had their data stolen in a 'sophisticated and malicious cyber-attack'
The company said around 53,000 passport numbers were also stolen in the attack, while less than 100 customers had a monthly financial statement stolen. 
A further 6.1 million records dating back to at least 2005 were also stolen.
Other information stolen includes some but not all of the following personal details: name, address, comment-223462 telephone number and date of birth. 
Latitude shares fell 1.7% to A$1.19 in early trade. 
'It is hugely disappointing that such a significant number of additional customers and applicants have been affected by this incident.

We apologise unreservedly,' Latitude chief executive Ahmed Fahour said in a release to the ASX.
'We are committed to working closely with impacted customers and applicants to minimise the risk and disruption to them, including reimbursing the cost if they choose to replace their ID document.

We are also committed to a full review of what has occurred,' said Fahour who retires from his position on Friday.
Earlier this month, the Melbourne-based company took its platform offline and said the Australian Federal Police and the Australian Cyber Security Centre were looking into the 'sophisticated and malicious cyber-attack'.
Latitude chief executive Ahmed Fahour has apologised 'unreservedly' for the data breach
Latitude said it will be writing to all customers and loan applicants whose information was stolen. 
Customers who choose to replace their stolen ID document will be reimbursed, the company said. 
Last year, some of Australia's largest companies reported data breaches, prompting authorities to step up efforts to bolster cybersecurity and implement stricter data-sharing rules to prevent breaches in the future.
Telecommunications firm Optus was the victim of a major cyber breach in September, with hackers obtaining the data of 10 million of its customers.
It will cost the company at least $140 million, including replacing hacked identity documents, complimentary subscriptions to credit monitor Equifax and an independent report commissioned by Deloitte. 
Meanwhile, health insurance company Medibank lost $2 billion from its market valuation after hackers accessed account details of almost 10 million current and former customers. 
It still faces an investigation by the Office of the Australian Information Commissioner over its handling of the incident.