OFX Data Breach Exposes Customer Information in New Zealand
A recent cybersecurity incident at OFX, a global foreign exchange and payments provider, has compromised sensitive customer data in New Zealand. The breach, which occurred on September 28, was first disclosed in an ASX filing on October 2, with further details released on October 15.
According to OFX, the attack did not grant hackers access to the company’s core client platform database or enable fraudulent payments. However, the exposed data described by Norton security expert Dean Williams as a "rich vein for identity theft" could still be exploited for impersonation and financial fraud. OFX has not disclosed how many New Zealand customers were affected.
The company confirmed that no identity documents were accessed, but customers were advised to take precautionary measures, including password changes and enabling two-factor authentication. The New Zealand Privacy Commissioner and other regulatory authorities have been notified, and OFX’s investigation remains ongoing.
This incident follows a 2023 compliance notice from New Zealand’s Department of Internal Affairs, which cited NZForex (a subsidiary of OFX) for failing to report 3,182 transactions under anti-money laundering regulations. The breach underscores growing cybersecurity risks in the financial sector, particularly for companies handling sensitive personal and transactional data.
OFX cybersecurity rating report: https://www.rankiteo.com/company/ofx
"id": "OFX1792124979",
"linkid": "ofx",
"type": "Breach",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Financial Services (Foreign Exchange and '
'Payments)',
'location': 'New Zealand',
'name': 'OFX',
'type': 'Company'}],
'customer_advisories': 'Customers advised to change passwords and enable '
'two-factor authentication',
'data_breach': {'personally_identifiable_information': 'Yes (unspecified '
'details)',
'sensitivity_of_data': 'High (potential for identity theft '
'and financial fraud)',
'type_of_data_compromised': 'Sensitive customer data '
'(excluding identity documents)'},
'date_detected': '2023-09-28',
'date_publicly_disclosed': '2023-10-02',
'description': 'A recent cybersecurity incident at OFX, a global foreign '
'exchange and payments provider, has compromised sensitive '
'customer data in New Zealand. The breach exposed data that '
'could be exploited for impersonation and financial fraud, '
'though no identity documents were accessed. OFX confirmed '
'that hackers did not access the core client platform database '
'or enable fraudulent payments.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'data exposure',
'data_compromised': 'Sensitive customer data (excluding identity '
'documents)',
'identity_theft_risk': 'High (per Norton security expert Dean '
'Williams)',
'payment_information_risk': 'None (fraudulent payments not '
'enabled)'},
'investigation_status': 'Ongoing',
'references': [{'date_accessed': '2023-10-02', 'source': 'ASX Filing'},
{'date_accessed': '2023-10-15',
'source': 'OFX Public Disclosure'},
{'source': 'Norton Security Expert (Dean Williams)'}],
'regulatory_compliance': {'regulations_violated': 'Potential non-compliance '
'with anti-money laundering '
'regulations (prior '
'incident in 2023)',
'regulatory_notifications': 'New Zealand Privacy '
'Commissioner, other '
'regulatory '
'authorities'},
'response': {'communication_strategy': 'ASX filing (October 2), further '
'details released (October 15)',
'remediation_measures': 'Customers advised to change passwords '
'and enable two-factor authentication'},
'title': 'OFX Data Breach Exposes Customer Information in New Zealand',
'type': 'Data Breach'}