--- title: "USForex / OFX internal-files access incident" description: "OFX disclosed access to internal processing files containing customer names and contact information, separate from its client platform." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-28" canonical_url: "https://www.ally.security/incidents/usforex-ofx-internal-files-access-2026" markdown_url: "https://www.ally.security/incidents/usforex-ofx-internal-files-access-2026.md" stix_url: "https://www.ally.security/incidents/usforex-ofx-internal-files-access-2026/stix.json" --- # USForex / OFX internal-files access incident The September 28 incident was identified the next day; OFX reported no unauthorized access to customer accounts or funds in the notice. Last modified Oct 28, 2026 · 3 sources ## Summary - **Environment:** OFX processing, reporting and internal-analysis files - **Operational impact:** Names and contact information accessed; client platform reported unaffected - **Financial impact:** No unauthorized account or funds access identified in the notice ## What happened [OFX](https://www.ofx.com/) said an unknown party accessed files used for processing, reporting and internal analysis on September 28, 2026. Its [US customer notice](https://oag.ca.gov/system/files/Client%20Comms%20-%20P3%20Consumer%20%5BUS%5D%2020261023_Redacted.pdf), filed under USForex Inc., dates discovery to September 29. [1](#source-1) [2](#source-2) ## Impact The sample lists names and/or usernames, postal addresses, email addresses and telephone numbers. It provides no affected-person total. OFX said the files were stored separately from the client platform, which was not accessed, and it had not identified unauthorized access to the recipient's account or funds. [1](#source-1) The October 15 public update also ruled out identity-document copies in the affected files and said services continued normally. Its earlier October 4 update described apparent data relating to non-client contacts, such as job applicants. [3](#source-3) ## Timeline ### September 28, 2026 — Internal files accessed An unknown party accessed the separately held files. [1](#source-1) ### September 29, 2026 — Incident identified Security and IT teams began containment. [1](#source-1) ### October 4, 2026 — Public update retained OFX described unauthorized access to client data and apparent information about non-client contacts. [3](#source-3) ### October 15, 2026 — Platform-database boundary confirmed OFX confirmed its client-platform databases were not accessed and services continued normally. [3](#source-3) ### October 28, 2026 — Briefing updated This briefing was last reviewed and updated on October 28, 2026. ## Threat Group & Attack Vector The reviewed notice does not identify how access was obtained. The earliest public update retained on the linked incident page is dated October 4; the reviewed evidence does not establish whether that was the first disclosure. [1](#source-1) [3](#source-3) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response OFX continued monitoring accounts and notifying relevant regulators. It warned about impersonation, advised passkeys and two-factor authentication, and provided incident support. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### OFX US consumer cybersecurity incident update official · USForex Inc. ### USForex Inc. data breach notification regulatory · California Attorney General · Oct 26, 2026 ### OFX Cybersecurity Incident official · OFX · Oct 4, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** USForex / OFX internal-files access incident: OFX said an unknown party accessed files used for processing, reporting and internal analysis on September 28, 2026; it detected the incident on September 29 and began containment. 2. **Resulted In · 100% confidence · current** USForex / OFX internal-files access incident: Internal files accessed 3. **Occurred At · 100% confidence · current** USForex / OFX internal-files access incident: 2026-09-28 4. **Resulted In · 100% confidence · current** USForex / OFX internal-files access incident: OFX continued monitoring accounts and notifying relevant regulators. It warned about impersonation, advised passkeys and two-factor authentication, and provided incident support. 5. **Resulted In · 100% confidence · current** USForex / OFX internal-files access incident: OFX’s October 15 update said the investigation confirmed client-platform databases were not accessed, the affected files contained no copies of identity documents, and none of the accessed data could be used to make payments on the OFX platform. Services continued normally; no unauthorized client account or funds access had been identified. 6. **Occurred At · 100% confidence · current** Incident identified: 2026-09-29 7. **Resulted In · 100% confidence · current** USForex / OFX internal-files access incident: Incident identified 8. **Resulted In · 100% confidence · current** USForex / OFX internal-files access incident: OFX confirms platform-database boundary 9. **Occurred At · 100% confidence · current** OFX confirms platform-database boundary: 2026-10-15 10. **Resulted In · 100% confidence · current** USForex / OFX internal-files access incident: OFX said the affected files were held separately from its underlying client platform, which was not accessed. It had not identified unauthorized access to the recipient’s OFX account or funds. 11. **Discovered At · 100% confidence · current** USForex / OFX internal-files access incident: 2026-09-29 12. **Occurred At · 100% confidence · current** OFX publishes retained public update: 2026-10-04 13. **Resulted In · 100% confidence · current** USForex / OFX internal-files access incident: The affected files contained names and/or usernames plus postal addresses, email addresses and telephone numbers. The sample does not establish the global affected population or every customer’s fields. 14. **Resulted In · 100% confidence · current** USForex / OFX internal-files access incident: OFX publishes retained public update 15. **Resulted In · 100% confidence · current** USForex / OFX internal-files access incident: The retained October 4 public update described unauthorized access to some client data and apparent data about non-client contacts such as job applicants. It does not give an affected-person total. 16. **Affected Organization · 100% confidence · current** USForex / OFX internal-files access incident: USForex Inc. 17. **Occurred At · 100% confidence · current** Internal files accessed: 2026-09-28