OFX, the international money transfer company, says an unauthorized party accessed some of its data on September 28, 2026. The company says client data and information about people such as job applicants may be involved, and it has not published how many people are affected.
OFX’s Data Breach Investigation
OFX Group Limited, which trades as OFX, is an Australian-listed company that provides international money transfers and foreign exchange services to individuals and businesses. Its U.S. subsidiary, USForex Inc., is a licensed money transmitter based in San Francisco. A company that moves money across borders collects identity, contact and transaction details from its clients, which makes the information it holds attractive to criminals.
OFX has dated the incident to September 28, 2026. According to the company, its IT and security teams began an investigation and put containment measures in place. On October 1, 2026, OFX determined that the incident met the thresholds that require it to notify regulators, and it began notifying regulatory and supervisory bodies. On October 2, 2026, OFX, which is listed on the Australian Securities Exchange, issued a public announcement that it was investigating a cybersecurity incident involving unauthorized access to data, including data relating to some clients. At that point it said it was still working to understand who and how many people were affected. The U.S. subsidiary’s notice was reported to the New Hampshire Attorney General on October 13, 2026.
On October 15, 2026, OFX updated its public notice and began emailing affected clients with more detail. The company says the unauthorized party did not access the databases that support its client platform. It says it has not identified any unauthorized access to client accounts or funds, that copies of identity documents were not accessed, and that none of the accessed data can be used to make a payment through the OFX platform. OFX says its services have kept running normally. It has also said the files involved appear to include data about people who dealt with OFX in non-client roles, such as job applicants.
The company’s notice lists the categories of information involved: names and usernames, contact details including addresses, email addresses and phone numbers, dates of birth, occupation, answers to secret questions, information about select transfers and the recipients who were paid, communications with OFX, IP addresses and device information, and social media web addresses. Some tracking sites show a generic checklist of data types, such as Social Security numbers, for every breach notice they list. This page relies on the list in OFX’s own notice rather than those labels.
OFX has not published how many people are affected, either overall or in the United States, and no group has publicly claimed responsibility. This page does not estimate a number. OFX says its investigation is continuing and that everyone whose data was accessed will be contacted directly.
The details involved are the kind that fuel targeted scams. A date of birth, an occupation and the answer to a secret question can help a fraudster pass identity checks over the phone or build a believable story about a recent transfer. Knowing a person’s recent recipients and transfers can make a fake message about a payment look real. OFX itself has warned affected people to expect impersonation attempts. Press coverage has also reported a customer who said OFX’s call center verified him using details of the same type that were involved in the incident, which shows why changing how you verify yourself matters. That is one customer’s account and not a finding about the company.
Whether a financial services company’s safeguards were adequate, and how quickly and clearly it told the people involved, are questions that remain open while its investigation continues. Those are the kinds of questions attorneys can ask on behalf of people who were harmed. Anyone who receives a notice should keep copies of every letter, email and message from the company, since those records can matter later if legal claims are pursued. People who applied for a job with OFX but never became clients should watch for a notice as well, because the company has said applicant data may be among the files involved.
When Did This Breach Occur?
OFX has dated the incident to September 28, 2026. It determined on October 1, 2026 that the incident met regulatory reporting thresholds, announced the investigation publicly on October 2, 2026, and began contacting affected clients with details of the data involved on October 15, 2026.
If you receive a notice, its own dates and description will be the most reliable record of the timeline for your information.
What Information Was Breached?
OFX says the data included names and usernames, contact information, dates of birth, occupation, answers to secret questions, information about select transfers and recipients, communications with OFX, IP addresses and device information, and social media web addresses. The company says copies of identity documents were not accessed and that the data cannot be used to make a payment.
Your own notice is the best source for which details apply to you.
What You Can Do
If you received a notice from OFX or believe you may be affected, consider these steps:
- Read the notice carefully and keep it. Change your OFX password, enable two-step authentication, and consider setting up a passkey if OFX offers one for your account.
- Change your secret question answers anywhere you reused them, and do not reuse OFX credentials on other sites.
- Be skeptical of unexpected calls, texts or emails about transfers or your account. Do not click links or open attachments in unexpected messages, and never share passwords or one-time codes.
- Review your OFX activity, bank statements and card statements for anything you do not recognize, and consider a free fraud alert or credit freeze with Equifax, Experian and TransUnion.
- Report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against OFX
If you are notified that your personal information was exposed in the OFX incident, you may have legal options. Companies that handle financial transactions are expected to safeguard the information their clients and applicants entrust to them, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
