Appendix E Redacted.pdf

From:
Cristian Cornejo
To:
Jeremy Williams
Subject:
RE: TVNZ query
Date:
Wednesday, 29 March 2023 3:39:07 pm
Attachments:
image001.png
image002.png
image003.png
image004.png
Awesome, thanks!
Cristián Cornejo (he/him)
Kaitohutohu Whakawhitiwhiti Matua| Senior Communications Advisor
Te Manu Karere | Communications
Te Tari Taiwhenua | Department of Internal Affairs
45 Pipitea Street | PO Box 805, Wellington 6140
Mobile:
dia.govt.nz | Facebook | LinkedIn
From: Jeremy Williams <[email address]>
Sent: Wednesday, 29 March 2023 3:37 pm
To: Cristian Cornejo <[email address]>; Julia Wootton
<[email address]>
Cc: Maria Robertson <[email address]>; John Crawford-Smith <John.Crawford-
[email address]>; Media Internal Affairs <[email address]>
Subject: RE: TVNZ query
I will follow up with latitude directly now
Jeremy
From: Cristian Cornejo <[email address]>
Sent: Wednesday, 29 March 2023 3:36 PM
under the Official Information Act 1982
To: Jeremy Williams <[email address]>; Julia Wootton
<[email address]>
Cc: Maria Robertson <[email address]>; John Crawford-Smith <John.Crawford-
[email address]>; Media Internal Affairs <[email address]>
Subject: FW: TVNZ query
Importance: High
Kia ora tīma,
Released
As you might have seen in the news, the Latitude breach story is becoming bigger by the minute.
We are getting media enquiries about the number of passports affected on a daily basis.

We have been using the agreed line – that we are still working closely with Latitude, but can’t
provide an updated number because the data is still being analysed – but it would really help if
we can provide an update on the number as soon as possible and work with Latitude to get
regular updates in the coming weeks.
I know we’ve come to you with this same request earlier this week and that a lot of it is out of
our control, but considering this is one of the biggest news stories right now, we think it’s worth
insisting with Latitude so we can answer the questions from the media to demonstrate we are
1982
on top of this .

Thank you and please let us know if we can help  in any way.

Act
Ngā mihi,

Cristián Cornejo (he/him)
Kaitohutohu Whakawhitiwhiti Matua| Senior Communications Advisor
Te Manu Karere | Communications
Te Tari Taiwhenua | Department of Internal Affairs
45 Pipitea Street | PO Box 805, Wellington 6140
Mobile:
dia.govt.nz | Facebook | LinkedIn
Information

From: Media Internal Affairs <[email address]>
Official
Sent: Wednesday, 29 March 2023 3:00 pm
To: Cristian Cornejo <[email address]>
Subject: FW: TVNZ query
the

Kia ora Cristian,

Is there any update?   This is an ongoing story and we will be getting requests for updated figures
while it remains a lead news item.  It would be great if Latitude had provided something we can
pass on to media today.
under

Ngā mihi nui,
Mary

Mary Burgess (she/her)
Senior Media Advisor
Te Tari Taiwhenua | Department of Internal Affairs
Released
Media phone |

1982
Act
Information
Official
the
under
Released

From:
Cristian Cornejo
To:
Jeremy Williams
Subject:
RE: Newshub - Update on Latitude hack
Date:
Tuesday, 28 March 2023 11:44:14 am
Attachments:
image001.png
image002.png
image003.png
Thank you!
1982

Cristián Cornejo (he/him)
Kaitohutohu Whakawhitiwhiti Matua| Senior Communications Advisor
Act
Te Manu Karere | Communications
Te Tari Taiwhenua | Department of Internal Affairs
45 Pipitea Street | PO Box 805, Wellington 6140
Mobile:
dia.govt.nz | Facebook | LinkedIn

Information

From: Jeremy Williams <[email address]>
Sent: Tuesday, 28 March 2023 11:15 am
To: Cristian Cornejo <[email address]>; Julia Wootton
<[email address]>
Cc: Maria Robertson <[email address]>; John Crawford-Smith <John.Crawford-
[email address]>; Media Internal Affairs <[email address]>
Official
Subject: RE: Newshub - Update on Latitude hack

The moment Latitude give us those numbers we will pass them on.
the

Jeremy

From: Cristian Cornejo <[email address]>
Sent: Tuesday, 28 March 2023 10:58 AM
To: Jeremy Williams <[email address]>; Julia Wootton
under
<[email address]>
Cc: Maria Robertson <[email address]>; John Crawford-Smith <John.Crawford-
[email address]>; Media Internal Affairs <[email address]>
Subject: RE: Newshub - Update on Latitude hack

Kia ora team,

We didn’t hear back from you about updated numbers for affected passports, so we went back
to the journalists with the agreed line about the data still being analysed.
Released
However, we’re still keen on providing an update when we know what the latest numbers are, so
please let us know when you hear back from Latitude about this.

Thank you!

Cristián Cornejo (he/him)
Kaitohutohu Whakawhitiwhiti Matua| Senior Communications Advisor
Te Manu Karere | Communications
Te Tari Taiwhenua | Department of Internal Affairs
1982
45 Pipitea Street | PO Box 805, Wellington 6140
Mobile:
dia.govt.nz | Facebook | LinkedIn
Act

From: Jeremy Williams <[email address]>
Sent: Monday, 27 March 2023 2:01 pm
To: Cristian Cornejo <[email address]>; Julia Wootton
<[email address]>
Information
Cc: Maria Robertson <[email address]>; John Crawford-Smith <John.Crawford-
[email address]>; Media Internal Affairs <[email address]>
Subject: RE: Newshub - Update on Latitude hack

Hi Cristian,

I’ve gone back to them to indicate we would like these numbers asap but obviously this remains
Official
out of our control. I will let you know if we get any further updates asap.

In the instance I cant get anything additional, your final paragraph is spot on – i.e. we’re still
the
waiting on Latitude.

I’ve attached the latest update we’ve got.

Jeremy

under
From: Cristian Cornejo <[email address]>
Sent: Monday, 27 March 2023 1:57 PM
To: Julia Wootton <[email address]>; Jeremy Williams
<[email address]>
Cc: Maria Robertson <[email address]>; John Crawford-Smith <John.Crawford-
[email address]>; Media Internal Affairs <[email address]>
Subject: RE: Newshub - Update on Latitude hack

Thanks for the quick reply, Julia.
Released
Do you think we could push for a number before the end of the day? It would reflect better on
the Department if we were known to have the latest information, reinforcing the idea that we

are on top of this.
If a getting a number before the end of the day is not possible, we can say we’re still working
closely with Latitude, but can’t provide an update number because the data is still being
analysed.

Ngā mihi,

1982
Cristián Cornejo (he/him)
Kaitohutohu Whakawhitiwhiti Matua| Senior Communications Advisor
Te Manu Karere | Communications
Te Tari Taiwhenua | Department of Internal Affairs
Act
45 Pipitea Street | PO Box 805, Wellington 6140
Mobile:
dia.govt.nz | Facebook | LinkedIn

Information
From: Julia Wootton <[email address]>
Sent: Monday, 27 March 2023 1:26 pm
To: Cristian Cornejo <[email address]>; Jeremy Williams
<[email address]>
Cc: Maria Robertson <[email address]>; John Crawford-Smith <John.Crawford-
[email address]>; Media Internal Affairs <[email address]>
Subject: RE: Newshub - Update on Latitude hack
Official

I’ve been in touch with Latitude this morning asking for an update on numbers. They don’t have
anything further at this stage as they are still analysing the dataset.
the

From: Cristian Cornejo <[email address]>
Sent: Monday, 27 March 2023 1:25 pm
To: Julia Wootton <[email address]>; Jeremy Williams
<[email address]>
Cc: Maria Robertson <[email address]>; John Crawford-Smith <John.Crawford-
under
[email address]>; Media Internal Affairs <[email address]>
Subject: FW: Newshub - Update on Latitude hack
Importance: High

Kia ora Jeremy,

I’m reaching out to you in Julia’s absence.

Following and update from Latitude Finance on how many passports, driver's licenses etc were
Released
compromised in their security breach, we’ve had a couple of media outlets reaching out to ask if
we can provide an updated number on the amount of NZ passports affected.

1982
Act
Information
Official
the
under
Released

newshub.co.nz
wbd.com
1982

Act

From:
@tvnz.co.nz>
Sent: Monday, 27 March 2023 1:08 pm
To: Media Internal Affairs <[email address]>
Subject: TVNZ query

Hi there,

I see Latitude has just put out an update confirming their hack is worse than initially
thought - and say that 53,000 passports were taken.
Information

Can someone from DIA confirm the number of NZ ones impacted if it's changed from last
week?

Cheers,

Official

the
under

Released

From:
Maria Robertson
To:
Jeremy Williams; Media Internal Affairs; Tiffany Scott
Subject:
Re: LFS - cyber-incident
Date:
Wednesday, 29 March 2023 5:35:51 pm
Attachments:
image002.png
image003.png
Yes, that’s fine thanks.
1982
If need be, go back to my messaging on the AM show last Wednesday.
M
Act
Maria Robertson| Deputy Chief Executive
Kawai Ki Te Iwi | Service Delivery and Operations
Mobile:
45 Pipitea Street | PO Box 805, Wellington 6140, New Zealand |  www.dia.govt.nz

Logo-test

From: Jeremy Williams <[email address]>
Information
Sent: Wednesday, March 29, 2023 1:53:56 PM
To: Media Internal Affairs <[email address]>; Maria Robertson
<[email address]>; Tiffany Scott <[email address]>
Subject: RE: LFS - cyber-incident

I think we have to be comfortable as ultimately latitude are the people that are in possession of
that information.
Official
@Maria Robertson and/or @Tiffany Scott – are you happy for us to run with the figures latitude
have provided below?

the
Jeremy

From: Media Internal Affairs <[email address]>
Sent: Wednesday, 29 March 2023 4:47 PM
To: Jeremy Williams <[email address]>
Subject: FW: LFS - cyber-incident
under

Kia ora Jeremy,

Cristian has passed this over to me while he deals with another piece of work.  We have noted
that the figure is already out there on TVNZ’s website:
Latitude confirms 34,600 NZ passports caught up in hack (1news.co.nz)
Presumably that has come directly from Latitude.
Are you comfortable with me going back to the media who have asked and providing that
approx.34.7k NZ figure?  Should we also clarify that that figure is for passport numbers only and
Released
that there are also 1,347 NZ passport images compromised?
Do we need to run this past Maria/Tiffany before it goes?  In which case are we happy with:

1982
Act
Information
Official
the
under
Released

Thanks
Julia

Draft banner wording:

Latitude Financial Services (GEM Finance) in Australia has advised of a cyberattack which may
have compromised New Zealand passport holders’ information. See here for more information.
1982
(link to page below)

Act

Draft web page wording
Latitude Financial Services data breach
Latitude Financial Services (also trading as GEM Finance in New Zealand), an Australian finance
company, has recently advised customers of a cyberattack which may have resulted in
unauthorised access to current and former customers’ information held by the company.
How do I know if I have been impacted by the data breach?
Latitude Financial Services is notifying all affected customers about the data breach. This
includes New Zealand passport holders who provided their New Zealand passport as part
Information
of setting up their accounts with Latitude Financial Services.
If you are not contacted by Latitude Financial Services, you have not been impacted by the
breach.
What passport details could have been exposed?
Some people had their New Zealand passport details compromised.
Official
A copy of your passport bio-data page may have been exposed.
Latitude Financial Services will advise you if your New Zealand passport details were
the
compromised.
Do I need to replace my passport if I have been impacted?
No, you don't have to.
under
If you have renewed your passport since signing up with Latitude Financial Services, you
do not need to do anything.
If you have not renewed your passport, there is no need to replace your passport if it is still
valid.
Can I use my passport to travel?
Yes, your passport is safe to use for international travel. Your passport remains valid for
travel unless it has expired or it has been renewed.
Released
Could someone else get a passport in my identity?

No. We use robust controls that protect your passport from identity takeover, including
sophisticated facial recognition technology.
Could someone use my passport details to travel in my identity?
No. They would need your actual passport, not just your passport details.
If your passport has been lost or stolen, you must let the Department of Internal Affairs
1982
(DIA) Passport Office know as soon as possible so we can cancel your passport and
protect you from any misuse.
Further information about lost and stolen passports is available here:
Act
Lost, stolen or damaged passport
Is it still safe to use my passport as proof of identity?
Impacted Latitude Financial Services customers may be concerned their passport details
could be misused to commit identity fraud.
You have the option to ask DIA to apply a block in the Australia Document Verification
Service (DVS) system on your behalf. This block will mean that your passport number
cannot be used for digital verification in Australia, but you can still use your passport to
verify your identity in person as required, such as for the purposes of taking out a loan, or a
Information
phone plan.
If you want DIA to apply a block in DVS, email us at: [email address].
Let us know your current passport number, name and contact phone number, including
area and country codes – we’ll call from New Zealand. Put ' Latitude Financial Services' in
the subject line.
Official
Is my passport still valid if I replace it?
If you choose to replace your passport, the previous one will be cancelled once we receive
your application.
the
Note that a cancelled passport cannot be used for travel or identification purposes.
You will need to wait until a replacement passport has been issued.
Information about passport timeframes is available here:
under
Passport timeframes
What happens if I replace my New Zealand passport while I am overseas?
We understand that you may be worried that you could be stranded without any valid ID
overseas. If you have upcoming international travel planned, we recommend that you
travel on your current passport.
If you would like to replace your passport, contact DIA to discuss your upcoming travel
plans before cancelling your passport.
Released

Confidentiality Disclosure Statement: This email and any attachments may contain legally
privileged, confidential information or copyright material of the sender or third party that
is intended for the use of the intended recipient only. Any confidentiality or privilege is not
waived or lost because this document has been sent by mistake. If you are not the intended
recipient, you must not read, copy, distribute, disclose or use the contents of this email or
any attachments without the consent of the sender or the relevant third party. If you have
received this mail in error, please delete it from your system immediately and notify us and 1982
confirm the deletion by responding to the email address you received this from. Except as
required by law, the sender does not represent or warrant that the integrity of this email has
been maintained or that it is free from errors, viruses, interceptions or interference. Any
personal information in this document must be handled in accordance with the privacy
Act
laws. Please see our Privacy Policy for information about our privacy practices in Australia
by visiting https://www.latitudefinancial.com.au/privacy/ and in New Zealand by visiting
https://www.gemfinance.co.nz/privacy/.
Confidentiality Disclosure Statement: This email and any attachments may contain legally
privileged, confidential information or copyright material of the sender or third party that
is intended for the use of the intended recipient only. Any confidentiality or privilege is not
waived or lost because this document has been sent by mistake. If you are not the intended
recipient, you must not read, copy, distribute, disclose or use the contents of this email or
any attachments without the consent of the sender or the relevant third party. If you have
received this mail in error, please delete it from your system immediately and notify us and
confirm the deletion by responding to the email address you received this from. Except as
Information
required by law, the sender does not represent or warrant that the integrity of this email has
been maintained or that it is free from errors, viruses, interceptions or interference. Any
personal information in this document must be handled in accordance with the privacy
laws. Please see our Privacy Policy for information about our privacy practices in Australia
by visiting https://www.latitudefinancial.com.au/privacy/ and in New Zealand by visiting
https://www.gemfinance.co.nz/privacy/.
Confidentiality Disclosure Statement: This email and any attachments may contain legally
Official
privileged, confidential information or copyright material of the sender or third party that
is intended for the use of the intended recipient only. Any confidentiality or privilege is not
waived or lost because this document has been sent by mistake. If you are not the intended
the
recipient, you must not read, copy, distribute, disclose or use the contents of this email or
any attachments without the consent of the sender or the relevant third party. If you have
received this mail in error, please delete it from your system immediately and notify us and
confirm the deletion by responding to the email address you received this from. Except as
required by law, the sender does not represent or warrant that the integrity of this email has
been maintained or that it is free from errors, viruses, interceptions or interference. Any
personal information in this document must be handled in accordance with the privacy
under
laws. Please see our Privacy Policy for information about our privacy practices in Australia
by visiting https://www.latitudefinancial.com.au/privacy/ and in New Zealand by visiting
https://www.gemfinance.co.nz/privacy/.
Released