{"id":632193,"date":"2026-10-16T07:44:10","date_gmt":"2026-10-16T07:44:10","guid":{"rendered":"https:\/\/www.newsbeep.com\/nz\/632193\/"},"modified":"2026-10-16T07:44:10","modified_gmt":"2026-10-16T07:44:10","slug":"ofx-data-breach-nz-customer-says-australian-foreign-exchange-firms-call-centre-verified-him-with-stolen-details","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/nz\/632193\/","title":{"rendered":"OFX data breach: NZ customer says Australian foreign exchange firm\u2019s call centre verified him with stolen details"},"content":{"rendered":"

\u201cI am appalled by their response and method of handling,\u201d the customer said.<\/p>\n

He supplied the answers and then cancelled his account.<\/p>\n

The customer identified himself to the Herald but did not want his name published, \u201cto provide fuel to the hackers\u201d.<\/p>\n

\u2018Rich vein of data for identity theft\u2019<\/p>\n

Norton security expert Dean Williams told the Herald it was a \u201csevere\u201d incident because the personal details accessed gave the hackers \u201ca rich vein of data\u201d for identity theft.<\/p>\n

To thwart impersonators, OFX customers should change passwords, enable two-factor authentication or passkeys, and vigilantly monitor for suspicious activity, \u201cOn everything, but particularly socials as an account takeover is challenging to restore, and unfortunately very useful for scamming the rest of your friends and family.\u201d<\/p>\n

ID Care<\/a> (0800 121 068), funded in part by the New Zealand Department of Justice, could provide advice if someone was worried their identity documents or credit rating had been compromised.<\/p>\n

No ability for hackers to make payments<\/p>\n

OFX said in the customer email, \u201cThe third party didn\u2019t access the underlying OFX client platform database. None of the data accessed can be used to make a payment from your OFX account and there was no access to any copies of your identity documents.\u201d<\/p>\n

The Office of the New Zealand Privacy Commissioner had been informed, along with other \u201crelevant regulatory and government authorities\u201d.<\/p>\n

\u201cOFX\u2019s investigation remains ongoing,\u201d the firm said in its October 15 ASX update. <\/p>\n

OFX acknowledged Herald questions, including how many New Zealand customers were affected, but did not immediately reply. <\/p>\n

September 28 breach<\/p>\n

The company first publicly revealed the breach, which took place on September 28, in an ASX filing on October 2.<\/p>\n

It was not until the follow-up ASX filing and customer email on October 15 that it could detail some of the information that had been accessed.<\/p>\n

OFX (formerly OzForex) owns 100% of NZForex, which was subject to an Anti-Money Laundering non-compliance notice<\/a> from the Department of Internal Affairs in March last year for failing to report 3182 transactions. <\/p>\n

Chris Keall is an Auckland-based member of the Herald\u2019s business team. He joined the Herald in 2018 and is the technology editor and a senior business writer.<\/p>\n","protected":false},"excerpt":{"rendered":"\u201cI am appalled by their response and method of handling,\u201d the customer said. He supplied the answers and…\n","protected":false},"author":2,"featured_media":632194,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[83031,1135,24812,4378,138,3043,1550,6852,3105,181,2174,25337,4756,209,52096,5420,16718,111,139,69,309977,8244,312,4736,233638,102,80],"class_list":["post-632193","post","type-post","status-publish","format-standard","has-post-thumbnail","category-business","tag-appalled","tag-australian","tag-australias","tag-breach","tag-business","tag-call","tag-centre","tag-customer","tag-data","tag-details","tag-exchange","tag-firms","tag-foreign","tag-group","tag-handling","tag-hes","tag-him","tag-new-zealand","tag-newzealand","tag-nz","tag-ofx","tag-recent","tag-says","tag-stolen","tag-verified","tag-with","tag-zealand"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/632193","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=632193"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/632193\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/632194"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=632193"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=632193"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=632193"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}