OFX Group — Data breach disclosed October 2026

New incident
Not stated
Independently corroborated

What this record states

OFX Group has reported a data breach.

The source states that information about customers was involved.

No source consulted for this record states when the incident occurred.

The number of people affected has not been stated.

Record overview

Incident date: Not confirmed
Discovery date: Not confirmed
Disclosure date: 16 October 2026
Notification date: Not confirmed
People affected: Not stated
Who was affected: customers

Each date is either established by a quoted source or explicitly not confirmed.

Affected people and data

Categories of affected data

Not stated

Notifications and response

Regulators notified

Office of the Australian Information Commissioner (OAIC)

Law enforcement notified

Australian Cyber Security Centre

Legal and formal response

notified the Australian Cyber Security Centre

Technical and organisational remediation

Not stated

Official sources

Official notice

OFX Confirms Customer Data Accessed In September Cyber Breach – SMBtech

smbtech.auRetrieved 16 October 2026

View official source

Further official sources

Corroborating report

Official publication

afr.comRetrieved 16 October 2026

View official source

Corroborating report

ASX-listed fintech firm discloses cyber incident impacting client data - Cyber Daily

cyberdaily.auRetrieved 16 October 2026

View official source

Cleverer commentary

This section is commentary by Cleverer, not reporting, and is not drawn from the sources cited above.

Cleverer Insight

The record says OFX began notifying affected customers after personal information was accessed in a cybersecurity breach described as occurring in September. It identifies customers as the affected group and records that OFX notified the Australian Cyber Security Centre and other global regulatory bodies.

The incident date, discovery date, number of affected people, data categories and remediation measures are not publicly established in this record. Although the supporting quotation refers to OFX confirming the types of data compromised, those types are not set out in the verified fields. The case illustrates the limits of the available public account: unauthorised access is recorded, but the mechanism and scope are not established.

How Cleverer may have helped

For this kind of failure, current records of preparation, access controls, incident response, customer notification decisions and communications with authorities may help an organisation reconstruct what occurred and demonstrate how it exercised oversight. Documented governance, training, policies and evidence of control review could also make later assessment and reporting more orderly.

None of this would necessarily have prevented the incident, and maintaining such evidence does not guarantee compliance, prevent penalties or ensure a particular security outcome. It may, however, assist with timely investigation, accountable decision-making and explaining the organisation’s response.