{"id":"figure-customer-records-breach-feb-2026","category":"breach","status":"closed","title":"Figure customer records stolen after employee social engineering and published online","tldr":"Figure customer and loan enquiry records were stolen and published online; HIBP counted about 967,200 email addresses. Some notification recipients also had bank details taken. Check your notice, monitor accounts and credit, and verify unexpected loan-related messages.","summary":"Attackers tricked a Figure employee into granting access, then stole customer information that was published online. Figure dates the database theft to 28 January 2026. Have I Been Pwned counted approximately 967,200 unique email addresses, with names, phone numbers, home addresses and dates of birth; this is not a company-confirmed total of affected people. ShinyHunters claimed responsibility, according to BleepingComputer. Figure's California notice additionally confirms bank account and routing numbers for the recipients covered by that sample. Figure said it stopped the activity and found no evidence of unauthorised access to customer accounts or funds. Its credit-monitoring enrolment deadline was 31 May. As at 3 November, the reviewed sources do not establish that the published data was recovered or removed, or whether it has been used in subsequent fraud. There is no software update for customers to install.","action":"Read your Figure notice to check which information was taken, and monitor bank statements and credit reports. Consider freezing your US credit files with Equifax, Experian and TransUnion, and independently verify unexpected loan-related messages. The published monitoring enrolment deadline has passed; contact Figure about any remaining support.","product":"Figure lending platform and loan enquiry records","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["figure","fintech","data-breach","social-engineering","personal-data"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Notice of Data Breach — California individual notification sample","url":"https://oag.ca.gov/system/files/L03_Figure%20Invididual%20Notification.pdf","by":"Figure","date":"2026-02-23"},{"kind":"research","title":"Figure Data Breach","url":"https://haveibeenpwned.com/Breach/Figure","by":"Have I Been Pwned","date":"2026-02-18"},{"kind":"news","title":"Data breach at fintech firm Figure affects nearly 1 million accounts","url":"https://www.bleepingcomputer.com/news/security/data-breach-at-fintech-firm-figure-affects-nearly-1-million-accounts/","by":"BleepingComputer","date":"2026-02-18"},{"kind":"news","title":"Fintech lending giant Figure confirms data breach","url":"https://techcrunch.com/2026/02/13/fintech-lending-giant-figure-confirms-data-breach/","by":"TechCrunch","date":"2026-02-13"},{"kind":"research","title":"Figure Lending database-query data incident","url":"https://www.ally.security/incidents/figure-lending-database-query-data-incident-2026","by":"Ally Security","date":"2026-08-09"},{"kind":"advisory","title":"Submitted Breach Notification Sample — Figure Technology Solutions","url":"https://oag.ca.gov/ecrime/databreach/reports/sb24-619176","by":"California Attorney General","date":"2026-02-23"}],"started":"2026-02-13","closed":"2026-05-31","created":"2026-11-03T21:18:39.681Z","updated":"2026-11-03T21:18:39.681Z","cve_notes":[],"timeline":[{"at":"2026-05-31","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"The enrolment deadline specified in Figure's California notice passed for its two years of free TransUnion credit monitoring and identity restoration.","url":"https://oag.ca.gov/system/files/L03_Figure%20Invididual%20Notification.pdf","by":"Figure","patch":null},{"at":"2026-02-23","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Figure's California notification was published. The company said it had stopped the activity, strengthened controls and notified law enforcement; its notice also confirmed bank account and routing numbers were taken for the recipients covered by that sample.","url":"https://www.ally.security/incidents/figure-lending-database-query-data-incident-2026","by":"Ally Security","patch":null},{"at":"2026-02-18","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Have I Been Pwned added the publicly posted data, counting approximately 967,200 unique email addresses. It identified names, phone numbers, home addresses and dates of birth alongside the email addresses.","url":"https://haveibeenpwned.com/Breach/Figure","by":"Have I Been Pwned","patch":null},{"at":"2026-02-13","added":"2026-11-03T21:16:05.524Z","kind":"disclosed","text":"Figure confirmed employee social engineering enabled the theft.","url":"https://techcrunch.com/2026/02/13/fintech-lending-giant-figure-confirms-data-breach/","by":"TechCrunch","patch":null},{"at":"2026-01-28","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Figure later identified this as the date attackers obtained personal information from databases holding loan and loan enquiry records.","url":"https://oag.ca.gov/system/files/L03_Figure%20Invididual%20Notification.pdf","by":"Figure","patch":"na"}],"url":"https://hard.fyi/live/figure-customer-records-breach-feb-2026/","json":"https://hard.fyi/api/live?id=figure-customer-records-breach-feb-2026"}