In the quiet machinery of modern finance, trust is often measured not by what a company promises but by what it protects. On September 28, Australian foreign exchange firm OFX suffered a data breach that exposed customer personal details — and weeks later, its own call centre was still using that stolen information to verify callers, a detail that speaks volumes about the gap between a company's crisis communications and its operational reality. The incident, which affected customers in New Zealand and Australia, has drawn warnings from security experts about the enduring risks of identity the
OFX data breach: NZ customers verified using stolen details, raising identity theft risks
New Zealand and Australian customers' personal data compromised, creating identity theft risk and requiring account security measures.
A rich vein of data for identity theft
Mark
So the breach happened on September 28, but the customer didn't find out until mid-October? That's a long gap.
Mimi
Yes. OFX filed with the ASX on October 2, but the customer email with details about what was actually taken didn't go out until October 15. That's when the call centre was still using the stolen data to verify people.
Luke
Wait—did OFX know on October 2 what had been accessed, or did they figure it out between October 2 and October 15?
Mimi
The company said it wasn't until the October 15 filing and email that it could detail what information had been accessed. So they knew something was wrong on October 2, but not the full scope.
Mark
And the customer called to cancel his account after receiving that email?
Mimi
Right. He called, the agent verified him using the stolen details, and he realized how exposed he still was. That's when he decided to pull out entirely.
Luke
Did OFX say how many New Zealand customers were affected?
Mimi
No. The Herald asked directly, and OFX acknowledged the question but didn't answer it.
Mark
So we don't actually know the scale of this in New Zealand.
Luke
We know it happened, we know it's serious enough that a security expert called it severe, and we know OFX didn't immediately disclose the scope. That's the story.
Mark
What can customers actually do now?
Mimi
Change passwords, enable two-factor authentication, watch for suspicious activity. And if they're worried about identity theft, there's ID Care—a free service funded by the Justice Department.
Luke
But the damage is already done. The data is out there. Those are damage-control measures, not prevention.
O Pulso
- OFX waited nearly three weeks after the September 28 breach before emailing affected customers — time enough for stolen data to circulate and cause harm.
- In a moment that alarmed security experts, OFX's own call centre verified a New Zealand customer using the very personal details that had been stolen, suggesting the company had not updated its verification protocols after discovering the breach.
- Though payment systems and identity documents were not accessed, security expert Dean Williams warns the stolen personal details are more than enough to fuel identity theft, fraud, and social media impersonation.
- Customers are urged to change passwords immediately, enable two-factor authentication, and monitor accounts closely — while OFX's investigation continues and regulators have been notified.
- The breach compounds existing concerns about OFX's compliance record, following a 2025 non-compliance notice for failing to report over three thousand transactions under anti-money laundering rules.
In the quiet machinery of modern finance, trust is often measured not by what a company promises but by what it protects. On September 28, Australian foreign exchange firm OFX suffered a data breach that exposed customer personal details — and weeks later, its own call centre was still using that stolen information to verify callers, a detail that speaks volumes about the gap between a company's crisis communications and its operational reality. The incident, which affected customers in New Zealand and Australia, has drawn warnings from security experts about the enduring risks of identity theft even when payment systems remain untouched.
When a New Zealand customer called OFX in mid-October to cancel his account, the call centre agent verified his identity using information that had already been stolen in a data breach weeks earlier. The moment crystallised, for him, just how poorly the company was managing the fallout — and he agreed to speak with the Herald only on condition of anonymity, fearing he might attract further attention from the hackers who now held his details.
The breach occurred on September 28. OFX filed a notice with the Australian Securities Exchange on October 2, but did not send explanatory emails to affected customers until October 15 — a delay of nearly three weeks that security experts found troubling. The company confirmed that hackers had accessed personal customer information, though not payment systems or copies of identity documents.
Dean Williams of Norton described the breach as severe. Personal details alone, he explained, provide attackers with enough material to commit identity theft and fraud. He urged OFX customers to change passwords immediately, enable two-factor authentication or passkeys, and watch for suspicious activity across their accounts and social media profiles.
OFX said it had notified the Office of the New Zealand Privacy Commissioner and other relevant authorities, and that its investigation was ongoing. When asked how many New Zealand customers were affected, the company did not provide a figure. Customers concerned about their credit rating or identity documents can contact ID Care — a service partly funded by the New Zealand Department of Justice — on 0800 121 068.
The breach arrives against a troubled backdrop. OFX's New Zealand subsidiary, NZForex, received a non-compliance notice in March 2025 for failing to report more than three thousand transactions under anti-money laundering rules. With stolen data still apparently in use inside the company's own call centre, questions about how well OFX safeguards what it holds remain, for now, unanswered.
An Australian foreign exchange company's response to a data breach has left at least one New Zealand customer convinced the firm is handling the crisis badly. When he called OFX to cancel his account in mid-October, the call centre agent verified his identity using information that had been stolen weeks earlier—a moment that crystallized, for him, how exposed customers remain even after a company discovers it has been breached.
The breach itself occurred on September 28. OFX, which owns NZForex, did not announce it publicly until October 2, when the company filed a notice with the Australian Securities Exchange. It took another two weeks—until October 15—before OFX sent customer emails explaining what data had actually been compromised. By that point, the damage was already done. A New Zealand customer, who agreed to speak with the Herald on condition his name not be published (he feared drawing further attention from hackers), described his frustration with the company's method of handling the incident. He supplied the answers the call centre agent requested and then cancelled his account.
Security researchers view the breach as particularly dangerous because of what was taken. Dean Williams, a security expert at Norton, told the Herald the incident was severe. The personal details accessed by the hackers gave them, in his assessment, a rich vein of data for identity theft. The stolen information was not payment credentials—OFX emphasized that hackers could not use the data to make payments from customer accounts, and they did not access copies of identity documents. But the personal details alone are enough to enable fraud. Williams recommended that OFX customers change their passwords immediately, enable two-factor authentication or passkeys, and monitor their accounts closely for suspicious activity, including on social media platforms where identity theft often begins.
OFX said it had informed the Office of the New Zealand Privacy Commissioner and other relevant regulatory and government authorities. The company's investigation remained ongoing as of mid-October. When asked how many New Zealand customers were affected by the breach, OFX acknowledged the Herald's questions but did not provide an immediate answer.
For customers worried their identity documents or credit rating had been compromised, ID Care—a service funded in part by the New Zealand Department of Justice—offers free advice. The service can be reached at 0800 121 068. The breach adds another layer of concern to OFX's regulatory history. The company's New Zealand subsidiary, NZForex, received a non-compliance notice from the Department of Internal Affairs in March 2025 for failing to report 3,182 transactions under anti-money laundering rules. Now, with personal data in the hands of unknown attackers and the company's own call centre still using that compromised information to verify customers, the question of how well OFX protects what it holds remains unanswered.
Citações Notáveis
The personal details accessed gave hackers a rich vein of data for identity theft— Dean Williams, Norton security expert
I am appalled by their response and method of handling— New Zealand OFX customer (name withheld)
Quer a matéria completa?
Leia o original em NZ Herald ↗
Business