Short answer
OFX Group, the Sydney-listed money transfer company, said in October 2026 that someone gained unauthorised access to data, including some client data and information about job applicants. OFX says its client platform databases were not accessed and it has found no unauthorised access to client accounts or funds.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | OFX Group |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Financial services (international money transfer) |
| Country | Australia |
| Disclosed | 2026-10-04 |
| People or records affected | Not disclosed. Includes some clients and non-clients such as job applicants. |
What data was exposed
- Data relating to some OFX clients (types not specified by OFX)
- Data relating to non-clients such as job applicants
- OFX says copies of identity documents do not appear to have been accessed
What happened
OFX Group Limited runs an international money transfer and currency exchange service. It is listed on the ASX and based in Sydney. In early October 2026 it told the market it was investigating a cybersecurity incident involving unauthorised access to data.
According to the company’s incident page, the first notice went up on 4 October and was last updated on 15 October 2026. Cyber Daily reported the ASX statement on 7 October.
What OFX has confirmed
OFX has said the incident involved data about some clients and about people who dealt with it in other roles, such as job applicants. It said its services and client platform remain available.
The company also made several narrower statements:
- the databases that support its client platforms were not accessed;
- it has not found unauthorised access to client accounts or funds;
- services and the client platform stayed available;
- it notified the Office of the Australian Information Commissioner, the Australian Signals Directorate’s Australian Cyber Security Centre, and other overseas authorities.
Cyber Daily reported that OFX would notify affected individuals once it confirmed their data was accessed. OFX has set up incident phone lines in Australia, New Zealand, the UK, Singapore, Hong Kong, Ireland, Canada and the United States.
What is still unknown
OFX has not said how many people are affected. It has not said when the access began, how it was found, or what kind of data was taken beyond the points above. No attacker has claimed responsibility, according to Cyber Daily, and OFX declined to comment further when asked.
Treat any claim about the size of the breach with caution until OFX or a regulator publishes figures.
Why this matters for scams
Even when no payment data is taken, names, contact details and transaction context are useful to fraudsters. A message that mentions a real currency transfer, or the name of a service you actually use, is much more convincing. Read our guide to phishing messages and the general advice on what to do after a data breach.
Payment pressure is the usual goal. A fake message that says a transfer is stuck or an account is frozen is a classic urgent payment scam. If someone rings and says they are from OFX, hang up and call the number on the incident page.
We list other recent incidents on the breaches page. Our editorial policy explains how we separate confirmed facts from claims.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake OFX emails or texts asking you to confirm a transfer, update your details or 'secure' your account
- Callers posing as OFX support who ask for a phone support code or password
- Fake job-application follow-ups from people claiming to be OFX recruiters, asking for ID or a fee
- Messages about a foreign currency payment you did not make, with a link to dispute it
What to do if you are affected
- 01Check your OFX account for transfers or changes you do not recognise, and call OFX straight away if you see any (Australia 1800 524 924, New Zealand 0800 482 922).
- 02Never share your password or a phone support code. OFX says its staff will not ask for them, and codes should only be given on calls you place to OFX.
- 03Set up passkeys on your OFX account and turn on two-step authentication for your email.
- 04Treat unexpected OFX emails, texts and calls as suspect. Do not click links. Go to the OFX site by typing the address yourself.
- 05If you applied for a job at OFX, watch for fake recruiter messages. Report scams to Scamwatch (NZ: Netsafe) and cyber incidents to ReportCyber.
- 06If you gave OFX identity documents or fear identity misuse, contact IDCARE, the free Australian and New Zealand identity support service.
Frequently asked questions
Was my money at risk in the OFX breach?
OFX says it has not identified unauthorised access to client accounts or funds, and that none of the accessed data can be used to make a payment on its platform. Check your account anyway.
Were my passport or licence copies stolen from OFX?
OFX says it does not appear that copies of identity documents were accessed. The company has not published a full list of the data types involved.
How do I know if I am affected?
Cyber Daily reported that OFX would notify affected individuals once their data access is confirmed. You can also use its dedicated incident lines, such as 1800 524 924 in Australia or 0800 482 922 in New Zealand.
I applied for a job at OFX. Should I worry?
OFX has said job applicants were among the non-client groups whose data may have been accessed. Be careful with unexpected recruiter contact, and never pay a fee or send ID to someone who contacts you first.
Who is behind the OFX attack?
Cyber Daily reported that no individual or group had claimed responsibility. OFX has not named an attacker or explained how the access happened.
Sources
- OFX Cybersecurity Incident, OFX, 2026-10-15
- ASX-listed fintech firm discloses cyber incident impacting client data, Cyber Daily, 2026-10-07
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.