“I am appalled by their response and method of handling,” the customer said.
He supplied the answers and then cancelled his account.
The customer identified himself to the Herald but did not want his name published, “to provide fuel to the hackers”.
‘Rich vein of data for identity theft’
Norton security expert Dean Williams told the Herald it was a “severe” incident because the personal details accessed gave the hackers “a rich vein of data” for identity theft.
To thwart impersonators, OFX customers should change passwords, enable two-factor authentication or passkeys, and vigilantly monitor for suspicious activity, “On everything, but particularly socials as an account takeover is challenging to restore, and unfortunately very useful for scamming the rest of your friends and family.”
ID Care (0800 121 068), funded in part by the New Zealand Department of Justice, could provide advice if someone was worried their identity documents or credit rating had been compromised.
No ability for hackers to make payments
OFX said in the customer email, “The third party didn’t access the underlying OFX client platform database. None of the data accessed can be used to make a payment from your OFX account and there was no access to any copies of your identity documents.”
The Office of the New Zealand Privacy Commissioner had been informed, along with other “relevant regulatory and government authorities”.
“OFX’s investigation remains ongoing,” the firm said in its October 15 ASX update.
OFX acknowledged Herald questions, including how many New Zealand customers were affected, but did not immediately reply.
September 28 breach
The company first publicly revealed the breach, which took place on September 28, in an ASX filing on October 2.
It was not until the follow-up ASX filing and customer email on October 15 that it could detail some of the information that had been accessed.
OFX (formerly OzForex) owns 100% of NZForex, which was subject to an Anti-Money Laundering non-compliance notice from the Department of Internal Affairs in March last year for failing to report 3182 transactions.
Chris Keall is an Auckland-based member of the Herald’s business team. He joined the Herald in 2018 and is the technology editor and a senior business writer.