Desk live·
ForensicPost
Breaches/Identity/File 26-0227

youX Breach Affected 444,500 Borrowers and 229,200 Driver's Licence Records

A breach at the Sydney fintech youX affected around 444,500 borrowers and 229,200 driver’s licence records, plus data relating to hundreds of broker organisations.

Constructed geometry · not a chart of case data
TargetyouX
ActorUnattributed
D. Kennedy8 min readConfidence: medium1 source reviewed

A breach at the Sydney-based lending platform youX affected approximately 444,500 borrowers, including around 229,200 driver’s licence records, alongside data associated with 797 broker organisations.

The Licence Count Is The Number To Watch

This desk filed the largest US licence exposure of the year at AssuranceAmerica in 26-0726, and made the point that a licence number is neither ceremonially protected nor practically replaceable.

In lending the licence is doing specific work: it is the identity document used to satisfy know-your-customer obligations. Its exposure therefore reaches the verification step that other institutions rely on, not merely the customer’s own account.

Brokers Are A Second Population With Different Exposure

Data relating to 797 broker organisations is a commercial exposure layered on the consumer one. A broker’s records identify their clients, their volumes and their commercial relationships.

It is the same structure filed at Allianz Life in 26-0610: a platform serving an intermediated market holds records for the intermediaries as well as the end customers, and the intermediaries are usually notified last.

Graded medium. The figures are consistently reported and the access route is not established.

How we reported this

Compiled from public reporting, listed below. The access route has not been established. Corrections: corrections@forensicpost.com.

Sources
  1. List of recent data breaches in 2026Bright Defense
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary