I have never heard of youX. How can my data be there?

youX is a Sydney-based asset finance technology platform that brokers (mortgage and car finance) use as the standard backend for processing loan applications. If you applied for a home loan, car loan, or other asset finance in Australia in recent years, your broker may have submitted your application through youX without explicitly naming the platform. Most affected Australians had no direct relationship with youX and were not told their data was being processed there.

Was my driver's licence really exposed?

Yes. According to reporting, 229,236 Australian driver's licence numbers were included in the leaked dataset, alongside residential addresses and dates of birth. If you applied for finance via a broker in this window, you should treat your driver's licence as compromised. Consider reporting the exposure to the state or territory authority that issued your licence and requesting a card replacement with a new number.

Is my actual loan account at risk?

No. youX held the loan application context (the data brokers used to assess and submit your application), not the active loan account itself. Your active loans live on the lender's books separately, and the lender's online banking credentials were not part of this breach. The main risk from the youX leak is identity fraud and targeted scams using the exposed personal and financial information.

What is the FulcrumSec leak site?

FulcrumSec is the threat actor that claimed responsibility for the youX breach and published the stolen data on a dark-web leak site after youX declined to pay extortion demands. Australia's cybersecurity minister has previously advised the public against searching for leaked data on dark-web sites. Accessing the stolen data may be illegal, and legitimate breach-checking services can tell you whether your email appears in known breaches without the need to visit those sites.

What should I do if I am a broker who used youX?

Approximately 8,000 broker employee password hashes were exposed as part of the leak, separate from the borrower dataset. If you or your team logged into youX, reset those credentials immediately, enable multi-factor authentication, and alert the lenders you work with so they can apply additional scrutiny to any applications submitted via youX credentials. Reviewing audit logs for unusual access in the preceding months is also sensible.

youX Data Breach 2026:
What You Need to Know

Sydney asset-finance platform youX exposed 444,538 Australian borrowers' loan application records, including 229,236 driver's licences, after leaving a MongoDB Atlas cluster open on the public internet for at least 10 months. Most affected Australians had never heard of youX; their data was fed in by their mortgage or car-finance broker.

Breach disclosed:17 February 2026

Records affected:~444,538 borrowers

Risk level:High

Your personal risk from this breach

View My Risk

What Happened

How the youX Breach Unfolded

August 2025 to February 2026

A youX MongoDB Atlas cluster sat open on the public internet for at least 10 months, accessible to anyone who knew the connection string. The cluster held loan application data fed into youX by mortgage and car-finance brokers across more than 90 lenders and 797 broker organisations.

17 February 2026

youX confirmed unauthorised access to the exposed database. The company notified the Office of the Australian Information Commissioner (OAIC) and the Australian Cyber Security Centre (ACSC), and obtained an injunction from the NSW Supreme Court restraining further dissemination of the impacted data.

Affected borrowers may have received a notification from youX or directly from their broker or lender. ASX-listed Motorcycle Holdings (ASX:MTO) disclosed its exposure to the incident in a formal ASX announcement on 18 February 2026.

May 2026

After youX declined extortion demands, the threat actor “FulcrumSec” listed youX on its dark-web leak site and published approximately 141 GB of stolen data, covering 444,538 unique borrowers and 629,597 loan applications.

Sources: Cyber Daily AU, ACS Information Age

What Was Exposed

Personal Data Leaked in the Breach

The leaked dataset is the loan application context youX held on behalf of the lenders and brokers that integrated with the platform. It combines identity-linked data (name, date of birth, address, driver's licence) with detailed financial records (income, debts, repayment history) for hundreds of thousands of Australians.

Data Type	Risk Level	Who Was Affected
Full name	High	All 444,538 affected borrowers
Email address	High	Subset of affected borrowers
Phone number	High	Subset of affected borrowers
Residential address	High	607,822 affected borrowers
Date of birth	High	All affected borrowers
Driver's licence number	High	229,236 affected borrowers
Income and debt records	High	All borrowers in scope (loan application context)
Loan application data	Medium	All 629,597 loan applications
Broker employee password hashes	Medium	Approximately 8,000 broker employees (separate cohort)

Risk levels based on the OAIC: What is personal information? and OAIC Australian Privacy Principles. Identity-linked data (name, date of birth, address, driver's licence) combined with detailed financial information (income, debts) is rated High because the combination supports both identity-fraud setup and targeted financial-scam approaches.

✅ Confirmed NOT Exposed

Bank account numbers, credit card details, and biometric data were not in scope of the breach. The leaked dataset is the loan application context held by youX, not your bank's records or your active loan accounts.

Company Response

What youX Did

“youX has obtained an injunction from the Supreme Court of New South Wales to prevent further access, disclosure or dissemination of the impacted data.”
youX statement, February 2026

Actions Taken by youX

Confirmed unauthorised access via internal forensics
Notified the OAIC and the Australian Cyber Security Centre (ACSC)
Obtained an injunction from the NSW Supreme Court restraining further dissemination of the data
Began direct notifications to affected borrowers, with parallel notifications via lenders and brokers
Engaged external incident responders
Hardened the MongoDB Atlas configuration: closed open clusters, added authentication, and applied IP allowlisting

ACSC (cyber.gov.au)OAIC Notifiable Data Breaches

What Now?

Steps You Can Take After the youX Breach

Because this breach combines name date of birth address driver's licence and detailed financial records, the most useful next steps focus on identity-document protection, credit monitoring, and locking down the email and phone numbers used in your loan application.

Driver's Licence Protection

229,236 driver's licence numbers were in the leak. Treat yours as compromised.

Report your driver's licence as compromised

~15 min

Contact the state or territory authority that issued your driver's licence (for example Service NSW, VicRoads, Service Victoria, TMR Queensland, Service SA, Transport WA, Access Canberra, Service Tas, or MVR NT). Most jurisdictions will replace your licence with a new card number on the basis that the original number has been exposed in a data breach. Many will waive the replacement fee where you can show the breach notification.

Add a flag with the document verification service

If your state or territory supports it, register that your licence has been exposed so that downstream identity-verification checks (for new credit, telco accounts, and so on) apply additional scrutiny to applications using that licence number.

Financial Account Monitoring

Identity documents plus income data make targeted credit fraud easier to attempt.

Place a free credit ban with Australian credit bureaus

~20 min

A credit ban prevents new credit from being opened against your identity without additional verification. Bans are free and can be placed for an initial 21 days, with extensions if there is evidence of identity-fraud risk (the youX notification can serve as that evidence).

Equifax AU Experian AU

Review bank statements for unfamiliar activity

Although bank account numbers were not in scope, the leaked income and debt records may be used to craft convincing impersonation attempts against your bank. Reviewing recent statements and enabling transaction alerts is a sensible precaution.

Alert your active lenders that your identity documents are exposed

If you have an active home loan, car loan, or other facility, a short note to your lender (via secure messaging or your broker) asking them to flag your file for identity-fraud risk can reduce the chance that a fraudulent variation, redraw, or refinance is processed without challenge.

Email and Digital Identity

The email and phone number you gave your broker were almost certainly in the leak.

Strengthen email security

~5 min

Update the password and enable MFA on the email account associated with your loan application. Check for unfamiliar forwarding rules or connected app permissions, which can be exploited to silently intercept communications from your bank or lender.

Set a port-out PIN on your mobile carrier

~10 min

Where phone number was part of the exposed data, contact your mobile carrier to set a SIM port-out PIN. SIM-swap fraud is commonly used to intercept verification codes and bypass MFA on banking and email accounts.

Telstra security

Understand your full account exposure

Most people have dozens of online accounts linked to a single email address. Mapping which services are connected helps you prioritise where to update passwords and review activity after a breach like this.

Monitoring and Reporting

Australian resources for breach response and identity protection.

Contact IDCare for tailored guidance

IDCare (1800 595 160) is Australia's national identity and cyber support service. They provide free, tailored guidance for people affected by data breaches, including case-managed support if you start to see signs of identity misuse.

Report scams and suspicious contact

Reporting attempted phishing or impersonation to Scamwatch and incidents of identity compromise to the ACSC helps authorities track how leaked data sets are being used in active scam campaigns.

Not sure which of your accounts are affected?

In The Event Of discovers your accounts automatically and alerts you in real time when new breaches affect your data.

Check My Email Free

Are You Still at Risk?

The Hidden Danger: Compound Breach Exposure

The youX breach did not happen in isolation. If your data also appeared in other major Australian breaches, the combination of leaked information can build a more complete identity profile.

How breach data compounds

On its own, the youX breach exposed names, dates of birth, addresses, driver's licence numbers, and detailed financial records. If your email or licence also appeared in the Optus, Medibank, or Latitude breaches, the combined data set can include identity documents, Medicare details, and health records. This kind of compound exposure significantly increases the risk of identity fraud.

Optus (2022)9.8M records - identity documents
Medibank (2022)9.7M records - health information
Latitude Financial (2023)14M records - identity documents
youX (2026)444K records - driver's licence, addresses, financial data

If your email or licence appears in two or more of these breaches, your risk level is significantly elevated. In The Event Of can overlay your breach data to show exactly where your exposure compounds, and help you prioritise what to address first.

Were you affected?

Find out in 30 seconds. Free to check.

Check My Email Free

No credit card required.

Frequently Asked Questions

youX Breach FAQ

Sources

Other Major Australian Data Breaches

Data from multiple breaches can be combined to increase identity fraud risk. Review these guides to understand your full exposure.

NYC Health + Hospitals Data Breach 2026

~1.8M records exposed

Critical

Australian Courts Data Breach 2026

Thousands of files records exposed

Critical

Prosura Data Breach 2026

300K-500K records exposed

High

Canvas (Instructure) Data Breach 2026

~275M (claimed) records exposed

Medium

Booking.com Data Breach 2026

Undisclosed records exposed

High

McGraw Hill Data Breach 2026

13.5M records exposed

High

Crunchyroll Data Breach 2026

Undisclosed records exposed

High

Eurail Data Breach 2026

300K+ records exposed

High

Basic-Fit Data Breach 2026

1M records exposed

High

Under Armour Data Breach 2025

72M records exposed

High

Salesforce (ShinyHunters) Data Breach 2025

~1B records exposed

High

Allianz Life Data Breach 2025

2.8M records exposed

High

Workday Data Breach 2025

Undisclosed records exposed

Medium

Western Sydney University Data Breach 2025

10K records exposed

High

Genea Fertility Data Breach 2025

940K records exposed

Critical

DeepSeek Data Breach 2025

1M records exposed

Medium

Tangerine Telecom Data Breach 2024

232K records exposed

High

Australian Clinical Labs Data Breach 2022

223K records exposed

Critical

Qantas Data Breach 2025

5.7M records exposed

High

Optus Data Breach 2022

9.8M records exposed

Critical

Medibank Data Breach 2022

9.7M records exposed

Critical

Latitude Financial Data Breach 2023

14M records exposed

Critical

MyDeal (Woolworths) Data Breach 2022

2.2M records exposed

High

View all breach guides →

Disclaimer: This guide is provided for general informational purposes only and does not constitute legal, financial, or professional advice. The information is based on publicly available sources at the time of writing and may not reflect the most current developments. In The Event Of Pty Ltd (ABN 38 687 352 647) is not affiliated with youX or any of the lenders or brokers that integrated with the youX platform. If you believe you have been affected by this data breach, we recommend contacting the relevant authorities and seeking professional guidance specific to your circumstances.

youX Data Breach 2026:What You Need to Know

How the youX Breach Unfolded

Personal Data Leaked in the Breach

✅ Confirmed NOT Exposed

What youX Did

Actions Taken by youX

Steps You Can Take After the youX Breach

The Hidden Danger: Compound Breach Exposure

How breach data compounds

Were you affected?

youX Breach FAQ

I have never heard of youX. How can my data be there?

Was my driver's licence really exposed?

Is my actual loan account at risk?

What is the FulcrumSec leak site?

What should I do if I am a broker who used youX?

Other Major Australian Data Breaches

youX Data Breach 2026:
What You Need to Know