Summary
- Environment: OFX processing, reporting and internal-analysis files
- Operational impact: Names and contact information accessed; client platform reported unaffected
- Financial impact: No unauthorized account or funds access identified in the notice
- Record status: Developing record. Reviewed October 28, 2026; updated as evidence emerges.
What happened
OFX said an unknown party accessed files used for processing, reporting and internal analysis on September 28, 2026. Its US customer notice, filed under USForex Inc., dates discovery to September 29. [1][2]
Impact
The sample lists names and/or usernames, postal addresses, email addresses and telephone numbers. It provides no affected-person total. OFX said the files were stored separately from the client platform, which was not accessed, and it had not identified unauthorized access to the recipient’s account or funds. [1]
The October 15 public update also ruled out identity-document copies in the affected files and said services continued normally. Its earlier October 4 update described apparent data relating to non-client contacts, such as job applicants. [3]
Timeline
Internal files accessed
An unknown party accessed the separately held files.
[1]Incident identified
Security and IT teams began containment.
[1]Public update retained
OFX described unauthorized access to client data and apparent information about non-client contacts.
[3]Platform-database boundary confirmed
OFX confirmed its client-platform databases were not accessed and services continued normally.
[3]Briefing updated
This briefing was last reviewed and updated on October 28, 2026.
Threat Group & Attack Vector
The reviewed notice does not identify how access was obtained. The earliest public update retained on the linked incident page is dated October 4; the reviewed evidence does not establish whether that was the first disclosure. [1][3]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
OFX continued monitoring accounts and notifying relevant regulators. It warned about impersonation, advised passkeys and two-factor authentication, and provided incident support. [1]