Almost 330,000 customer records and identification documents have been stolen from Latitude Financial.
The company says it appears to have been hit by a sophisticated and malicious cyber attack, originating from a major vendor.
It believes criminals accessed an employee's log-in credentials, then stole customer information from two service providers.
About 103,000 identification documents appear to have been stolen from one provider, believed to be mostly drivers' licences.
A further 225,000 customer records were stolen from the second provider.
The company has apologised and says it is contacting impacted customers.
Latitude Group Holdings Limited is in a trading halt until Monday.