Figure customer records stolen after employee social engineering and published online
Figure customer and loan enquiry records were stolen and published online; HIBP counted about 967,200 email addresses. Some notification recipients also had bank details taken. Check your notice, monitor accounts and credit, and verify unexpected loan-related messages.
Read your Figure notice to check which information was taken, and monitor bank statements and credit reports. Consider freezing your US credit files with Equifax, Experian and TransUnion, and independently verify unexpected loan-related messages. The published monitoring enrolment deadline has passed; contact Figure about any remaining support.
What’s happening
Attackers tricked a Figure employee into granting access, then stole customer information that was published online. Figure dates the database theft to 28 January 2026. Have I Been Pwned counted approximately 967,200 unique email addresses, with names, phone numbers, home addresses and dates of birth; this is not a company-confirmed total of affected people. ShinyHunters claimed responsibility, according to BleepingComputer. Figure's California notice additionally confirms bank account and routing numbers for the recipients covered by that sample. Figure said it stopped the activity and found no evidence of unauthorised access to customer accounts or funds. Its credit-monitoring enrolment deadline was 31 May. As at 3 November, the reviewed sources do not establish that the published data was recovered or removed, or whether it has been used in subsequent fraud. There is no software update for customers to install.
- What
- Breach
- Affects
- Figure lending platform and loan enquiry records
- Fixed in
- Nothing to patch
- Since
- 13 Feb 2026
- Closed
- 31 May 2026
Timeline
- Update
The enrolment deadline specified in Figure's California notice passed for its two years of free TransUnion credit monitoring and identity restoration.
- Update
Figure's California notification was published. The company said it had stopped the activity, strengthened controls and notified law enforcement; its notice also confirmed bank account and routing numbers were taken for the recipients covered by that sample.
- Update
Have I Been Pwned added the publicly posted data, counting approximately 967,200 unique email addresses. It identified names, phone numbers, home addresses and dates of birth alongside the email addresses.
- Made public
Figure confirmed employee social engineering enabled the theft.
- UpdateNothing to patch
Figure later identified this as the date attackers obtained personal information from databases holding loan and loan enquiry records.
Sources
- Notice of Data Breach — California individual notification sampleFigure · 23 Feb 2026
- Figure Data BreachHave I Been Pwned · 18 Feb 2026
- Data breach at fintech firm Figure affects nearly 1 million accountsBleepingComputer · 18 Feb 2026
- Fintech lending giant Figure confirms data breachTechCrunch · 13 Feb 2026
- Figure Lending database-query data incidentAlly Security · 9 Aug 2026
- Submitted Breach Notification Sample — Figure Technology SolutionsCalifornia Attorney General · 23 Feb 2026