tastyfx, the retail forex trading brand operated by tastyfx LLC in Chicago, has reported a data breach to a state regulator. This page explains what the public filing says, what has not been disclosed and what account holders can do now.
The details below come from a state attorney general listing and may change as the company releases more information.
tastyfx’s Data Breach Investigation
tastyfx is the trading name of tastyfx LLC, a Chicago-based firm that offers spot foreign exchange trading to retail customers in the United States. The company’s own disclosures describe it as a retail foreign exchange dealer registered with the Commodity Futures Trading Commission and as a member of the National Futures Association. Customers open accounts with the firm, log in to a trading platform and keep money on deposit to trade currency pairs.
The breach became public through the Vermont Attorney General’s security breach notice listing. The entry for tastyfx is dated November 10, 2026, the date the breach was reported to the attorney general’s office. The listing classifies the company as a financial services organization and states that 2 Vermont residents were affected.
That count is small, and it should be read carefully. Vermont reports only its own residents, so the figure says nothing about how many people in other states may have been affected. Companies in this position often send notices to residents of several states, and they may file separate reports with other regulators. No nationwide total for tastyfx has been published, and this page does not estimate one.
The listing names a single category of information: login credentials. It does not say whether that means usernames, passwords, security answers or some combination of these. It does not say whether the credentials were for the customer trading platform, for another service or for an internal system, and it does not say whether the information was exposed in readable form.
Filings like this one are often the first public sign of an incident, and they tend to be updated or supplemented later. A company may learn more about the scope of an event after its initial report, and regulators in other states may post their own entries at different times. For that reason, it is sensible to check for updates over the coming weeks rather than treating the first listing as the final word on who was affected.
Equally important is what the filing leaves out. It does not describe how the incident happened, when it began, when it was discovered or whether an outside party obtained any data. It does not say whether the people affected were customers, former customers, prospective customers or employees. Until tastyfx gives its own account of the incident, the cause and the full scope remain unknown.
Login credentials matter more than they might appear, especially for a financial account. A person who obtains a working username and password may be able to sign in as the account holder, view personal and financial details stored in the account and attempt to move funds or place trades. Many people also reuse the same password on several sites, so a credential taken from one service can be tried against email, banking and shopping accounts elsewhere. That risk exists even when no other category of information is listed in a filing.
Trading and brokerage customers are also common targets for impersonation scams. After a breach, criminals sometimes send messages that appear to come from the firm, asking the recipient to confirm a password, verify an account or transfer money to protect it. Treat any unexpected message about your account with caution, and do not click links or call numbers in a message you did not expect. Go to the company’s website directly or use the contact details on your account statements.
State breach laws require companies to notify the people affected, and each state sets its own rules for timing and content. If you receive a written or electronic notice from tastyfx, keep it, since it is the best record of what the company says was involved and what protection it is offering. If you hold or once held an account with the firm and have not received a notice, you can begin the protective steps below while more details come out.
When Did This Breach Occur?
The listing gives November 10, 2026 as the date the breach was reported to the Vermont Attorney General. It does not provide the date the incident occurred, the date it was discovered or the date notices were sent to affected people. Those dates have not been made public. If tastyfx or another regulator publishes a fuller notice, compare its timeline with the date on any notice you received.
What Information Was Breached?
According to the Vermont listing, the information involved was login credentials. The listing does not name any other category, and it does not explain whether the credentials were usernames, passwords or both. Because the company has not published its own notice, it is not clear whether other account details were involved. Read any notice you receive closely to see which items apply to you.
What You Can Do
If you received a notice related to tastyfx or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Because login credentials are the category listed, change your password for any account with the company and for any other account that shares it, turn on multi-factor authentication, and check your account for activity you did not authorize.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against tastyfx
Attorneys are looking into the data breach reported by tastyfx and want to hear from people who received a notice. A lawsuit has not been confirmed, and whether you can seek compensation depends on what the company ultimately confirms about the incident. If you received a notice or believe your information was exposed, an attorney can explain whether you may be able to join a class action lawsuit.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
