Key Highlights

  • OFX Group Limited advised on 2 October 2026 that it is investigating a Cybersecurity incident involving unauthorised access to data, including data relating to some clients.
  • At this stage, OFX has not identified unauthorised access to client accounts or funds, and based on information available to date there has been no financial loss to clients.
  • OFX is still working to establish the identity and number of clients whose data may have been accessed, and data of non-client individuals such as Job applicants may also have been accessed.
  • OFX has notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and other global regulatory authorities.

Introduction: A Global Payments Provider Under Scrutiny

OFX Group Limited (ASX:OFX) is a money transfer and financial operations company that provides clients with real-time financial control and visibility to do Business anywhere in the world. The group offers global business accounts, money transfers, payments, corporate cards with spend management, and currency risk management solutions.

Headquartered in Sydney, OFX has around 700 employees and offices in the United States, Canada, the United Kingdom, Ireland, New Zealand, Singapore and Hong Kong. The company has been listed on the ASX since 2013, is ISO/IEC 27001:2022 certified and is licensed in around 50 jurisdictions. Over more than 25 years, it has helped clients move and manage money in more than 50 currencies to more than 180 countries.

Latest Development: Investigation Into Unauthorised Data Access

In an ASX announcement dated 2 October 2026, OFX advised that it is investigating a cybersecurity incident involving unauthorised access to data, including data relating to some clients. The company stated that its IT and Security teams responded immediately upon becoming aware of the incident and have implemented containment actions.

On client funds and operations, OFX reported that it has not identified any unauthorised access to client accounts or funds and that, based on information available to date, there has been no financial loss to clients. Its services and systems continue to operate normally and remain fully available.

On the data itself, the picture is still incomplete. OFX said it is still working to understand the identity and number of clients whose data may have been accessed. At this stage, it does not appear that copies of identity documents have been accessed, and it also appears that none of the data accessed can be used to make a payment on the OFX platform. However, data relating to individuals who have interacted with OFX in non-client capacities, such as job applicants, may also have been accessed.

The announcement did not quantify the number of affected individuals, did not state when the incident occurred, and did not provide an estimate of any cost to the company.

Regulatory Context and Notifications

OFX has notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and other global regulatory authorities, and said it will work with the appropriate authorities in relation to the incident. The reference to global regulators sits alongside the company's presence in multiple regions and its licensing across around 50 jurisdictions.

The company stated that all clients and individuals affected will be contacted directly once OFX can confirm that their data has been accessed. It described its investigations as continuing as a matter of urgency and said it will provide further updates as appropriate. The announcement was authorised by the OFX Group Limited Board of Directors, with media and investor enquiries directed to Matthew Gregorowski at Sodali & Co.

What to Watch Ahead

Several data points remain open following the 2 October update. These include the identity and number of clients whose data may have been accessed, the final scope of non-client data involved, and whether the initial findings on identity documents and payment-capable data hold as the investigation progresses.

Further ASX updates from OFX, the timing of direct contact with affected clients and individuals, and any outcomes from the company's engagement with the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and other regulators are also items that market readers may track.

The Bottom Line

OFX Group (ASX:OFX) has disclosed an active cybersecurity investigation in which data access has been confirmed as unauthorised, while the company reports no identified access to client accounts or funds, no financial loss to clients to date, and normal service availability. Against this, the number and identity of affected clients are not yet known, non-client individuals may also be affected, and the investigation is ongoing. Further company updates will determine how the picture develops.