What happened
In February 2026 the loan-brokerage platform youX confirmed that personal information had been accessed and downloaded after data was uploaded to a hacking forum [youx-acs], [youx-cd]. The group responsible, FulcrumSec, claimed the data covers 444,538 borrowers and 629,597 loan applications, including home addresses, income and debt details, government IDs and financial-hardship notes; youX has not confirmed these figures or descriptions [youx-acs]. youX obtained an injunction from the NSW Supreme Court restraining access to and dissemination of the data, as reported [youx-acs].
Current status
No further action. In its final update (4 April 2026), youX said the OAIC and the National Office of Cyber Security had formally closed their reviews with no further action required [youx-co]. This is youX’s statement; no OAIC publication about the incident has been located. The attacker’s figures, and its claim that the data reached major lenders, are unverified and are not asserted here [youx-acs].
Why it matters
Loan applications concentrate the most sensitive financial and identity data a person holds, making a breach of them particularly damaging.