OFX Group (ASX: OFX): cybersecurity incident update (15 Oct) — client-platform databases not accessed; some personal information in affected files; no client account/fund access or financial loss identified
OFX Group Limited, the Sydney-based ASX-listed money transfer and financial operations company, first advised the market on 2 October 2026 that it was investigating a cybersecurity incident involving unauthorised access to data, including data relating to some clients, and that it had notified the Australian Cyber Security Centre, the OAIC and other global regulators. Its 15 October 2026 update says the investigation has confirmed that the databases supporting its client platforms were not accessed; based on the investigation to date, OFX has not identified any unauthorised access to client accounts or funds, or any financial loss to clients arising from the incident; and services and systems have continued to operate normally. Analysis of the data found some personal information in the affected files; the files did not contain copies of identity documents, and none of the accessed data can be used to make a payment on the OFX platform. OFX says it has implemented containment actions and additional monitoring of client accounts, is communicating with affected clients and individuals (including recommended protective steps), and is arranging specialist identity and cyber support services where available. The investigation remains ongoing; OFX does not anticipate further market updates unless material developments require continuous disclosure. Primary: OFX ASX announcement 15 Oct 2026; earlier: OFX ASX announcement 2 Oct 2026.
- Product
- OFX Group client and non-client personal information (affected files; client-platform databases not accessed per 15 Oct update)
- Versions
- n/a — incident (announced 2 Oct 2026; investigation update 15 Oct 2026)
- Exploited in Australia?
- unknown
- Patch to
- OFX clients and individuals contacted by OFX: follow the protective steps in OFX's outreach and treat unexpected payment, identity or account messages as suspect. Organisations holding client PII outside core transaction databases: inventory those file stores and monitoring paths, because breach scope can sit outside the main platform databases.
Primary: OFX Group — Update on cybersecurity incident (ASX, 15 Oct 2026) · Vendor: OFX Group Limited (ASX: OFX) · OFX Group — Cybersecurity incident (ASX, 2 Oct 2026)