Breach · · 3 min read
OFX breach: what Canadian and other money-transfer clients should know
International money-transfer company OFX says data about some clients and job applicants was accessed on September 28, including birth dates and security-question answers.
OFX, the Australian-listed international money-transfer company, is notifying clients that some of their personal information was accessed in a cyberattack in late September. OFX serves clients in Canada, the U.S., the U.K., Ireland, Australia, New Zealand and Asia, and lists a Canadian support line for the incident. If you’ve sent money abroad with OFX, or applied for a job there, here’s what is known.
What happened
OFX told affected clients that the unauthorized access happened on September 28, 2026, and that its security team found and contained it the next day, SMBtech reported. The company’s incident page says its investigation confirmed that the databases behind its client platforms were not accessed, that it hasn’t seen any unauthorized access to accounts or funds, and that the affected files didn’t contain copies of identity documents.
According to the notices described by SMBtech, the data accessed can include:
- names and usernames
- addresses, email addresses and phone numbers
- dates of birth and occupation details
- answers to secret questions
- information about some transfers and recipients
- details of some conversations with OFX
- IP addresses, device information and social media URLs
OFX says none of it can be used to make a payment from an OFX account. People who dealt with OFX without being clients, such as job applicants, are affected too. OFX says it is contacting everyone affected directly. No group has claimed the attack.
What this means for you
The answers to secret questions are the part to act on. If you used the same answer elsewhere, like your mother’s maiden name or your first school, that answer is no longer secret. Transfer and recipient details also give scammers a convincing script: “there’s a problem with your transfer to [name], please confirm.”
What you can do
- Change security answers you reused anywhere else. Better yet, use a random answer stored in a password manager.
- Set up a passkey and two-step sign-in on your OFX account, as OFX recommends, and on your email.
- Never share a one-time code or password. OFX says its staff will never ask for them.
- Call OFX yourself if a message worries you. The incident page lists (844) 301-0359 for Canada and the U.S. For account questions it points to questions@ofx.com.
- Watch for transfer-themed scams. See how scammers use leaked data.
How Frame helps
Once you’ve heard from OFX, you can add the breach to a verified email in Frame. Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. If you’re in Canada, our guide on what to do after a data breach covers fraud alerts and credit freezes with the Canadian credit bureaus. We never collect or store the leaked records themselves.
Sources
- OFX, OFX Cybersecurity Incident, updated October 15, 2026
- SMBtech, OFX Confirms Customer Data Accessed In September Cyber Breach, October 16, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.