Almeida Law Group is investigating a data breach at USForex Inc. The breach occurred on September 28th, 2026. If you were affected, contact Almeida Law Group.
About USForex Inc.
USForex Inc. is the U.S. subsidiary of OFX Group Limited (ASX: OFX), an Australia-headquartered global financial services company that provides international money transfers, foreign exchange, and payment solutions for individuals and businesses. USForex operates as a licensed money transmitter under the trade name OFX and is based at 49 Stevenson St, San Francisco, California. OFX Group is listed on the Australian Securities Exchange and is headquartered in Sydney, Australia. Because USForex handles international financial transactions, it collects sensitive personal and financial data from its customers, making any unauthorized access to that data a serious concern.
What Happened?
USForex Inc. was listed in a California Attorney General sample breach notice reported on October 26th, 2026. According to that filing and supplemental research, unauthorized access to USForex’s systems occurred on September 28th, 2026. OFX Group’s IT and security teams responded and implemented containment measures. By October 1st, 2026, OFX determined the incident met regulatory reporting thresholds and disclosed the cybersecurity incident via an ASX announcement on October 2nd, 2026. The company notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and other global regulatory authorities. The breach was also reported to the New Hampshire Attorney General on October 13th, 2026. OFX confirmed that its underlying client platform databases were not accessed, no copies of identity documents were accessed, and no unauthorized access to client accounts or funds was identified. Data relating to non-client individuals, such as job applicants, may also have been accessed. No hacker or hacking group has publicly claimed responsibility, and the total number of affected individuals has not been disclosed.
According to a BeyondMachines report citing OFX’s October 15th, 2026 update, the data types potentially accessed include names, usernames, and contact information; dates of birth and occupation details; answers to security questions; information about selected transfers and payment recipients; customer communications and interactions with OFX; and IP addresses, device information, and social media URLs. OFX stated that no data accessed could be used to make payments on its platform. A class action complaint, Reimer v. USForex, Inc. d/b/a OFX (Case No. 3:2026cv12434), was filed on October 23rd, 2026, in the U.S. District Court for the Northern District of California. Law firm Shamis & Gentile P.A. has also announced a separate investigation into the breach for a potential class action lawsuit.
Key Facts at a Glance
- Company or Organization: USForex Inc. (d/b/a OFX), U.S. subsidiary of OFX Group Limited
- Industry: International money transfers, foreign exchange, and payment services (fintech / financial services)
- Location: 49 Stevenson St, San Francisco, California; parent company headquartered in Sydney, Australia
- Incident type: Unauthorized access to data
- Date of breach: September 28th, 2026
- Date breach discovered: October 1st, 2026
- Date of consumer notification: October 26th, 2026 (California AG filing)
- Litigation status: Class action filed October 23rd, 2026 — Reimer v. USForex, Inc. d/b/a OFX, Case No. 3:2026cv12434, N.D. Cal.; Shamis & Gentile P.A. also investigating
- Source: California Attorney General Breach Report; BeyondMachines; Kalkine; Justia Dockets
What Should You Do?
If you received a notification from USForex or OFX, take steps now to protect yourself. Place a fraud alert or credit freeze with all three major credit bureaus — Equifax, Experian, and TransUnion — to prevent unauthorized accounts from being opened in your name. Review your credit reports for free at AnnualCreditReport.com and monitor your bank and financial accounts closely for any suspicious activity. Because security question answers and contact details may have been exposed, be alert to phishing attempts, scam calls, and social engineering attacks where someone uses your personal information to appear legitimate. If identity theft does occur, report it and get a recovery plan at IdentityTheft.gov.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
