OFX Group Limited, the Sydney-based ASX-listed money transfer and financial operations company, first advised the market on 2 October 2026 that it was investigating a cybersecurity incident involving unauthorised access to data, including data relating to some clients, and that it had notified the Australian Cyber Security Centre, the OAIC and other global regulators.

Its 15 October 2026 update says the investigation has confirmed that the databases supporting its client platforms were not accessed; based on the investigation to date, OFX has not identified any unauthorised access to client accounts or funds, or any financial loss to clients arising from the incident; and services and systems have continued to operate normally. Analysis of the data found some personal information in the affected files; the files did not contain copies of identity documents, and none of the accessed data can be used to make a payment on the OFX platform.

OFX says it has implemented containment actions and additional monitoring of client accounts, is communicating with affected clients and individuals (including recommended protective steps), and is arranging specialist identity and cyber support services where available. The investigation remains ongoing; OFX does not anticipate further market updates unless material developments require continuous disclosure.

UPDATE 15–16 October: OFX's incident page (last updated 15 October) says it is moving into a 'next phase' of communications in which affected clients and individuals are told exactly what information about them was accessed, and it has set up incident phone lines in each region (Australia 1800 524 924) plus questions@ofx.com for account enquiries.

BeyondMachines (16 October), reporting on those notifications, says the unauthorised access happened on 28 September and that the files exposed names and usernames, contact information, dates of birth, occupation details, answers to secret questions, details of selected transfers and payment recipients, some customer communications, IP addresses and device information, and social media URLs.

OFX has not said how many people are affected; BeyondMachines says the New Zealand Privacy Commissioner was also notified.

OFX warns the data could be used for scams and impersonation, and says its staff will never ask for passwords, one-time codes or security details. Primary: OFX ASX announcement 15 Oct 2026 and OFX incident page; earlier: OFX ASX announcement 2 Oct 2026.

Correction (23 Oct 2026): the headline stated the exposed-data list as OFX's own; it comes from BeyondMachines' reporting on OFX's notifications. Removed 'identified and contained the next day', which only an unreadable source carried. (source: https://beyondmachines.net/event_details/ofx-group-confirms-unauthorized-access-to-client-and-applicant-personal-information-b-g-n-3-l)