SoFi Confirms Unauthorized Access to Hong Kong Subsidiary’s Vendor Database
Summary
SoFi confirmed unauthorized access to a vendor-managed database belonging to its Hong Kong subsidiary, discovered April 30, 2026. The investigation is ongoing, and the company has not determined what customer data may have been exposed.
Key points
- SoFi Hong Kong detected unauthorized access to a vendor-managed database on April 30, 2026.
- The database belonged to SoFi Securities (Hong Kong) Limited.
- SoFi has engaged a third-party cybersecurity firm, and its investigation is ongoing.
- The company has not determined which customer data, if any, was exposed or how many customers were affected.
- SoFi advised customers to update passwords, enable two-factor authentication, monitor financial activity, and watch for phishing and suspicious communications.
- The company says it added safeguards and monitoring to affected accounts.
Article Details
- Victim Organization
- SoFi Securities (Hong Kong) Limited
- Incident Type
- Unauthorized access to a third-party vendor-managed database; data breach
- Incident Date
- 2026-04-30
- Data Types Exposed
- Customer information may have been exposed; the specific data categories are unknown.
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Unauthorized access to the vendor-managed database was detected. No service disruption was reported.
- Ransom Or Extortion
- Unknown; SoFi declined to say whether it was extorted.
- Claim Status
- confirmed