Figure Technology Solutions 2026 Data Breach
Financial institution · Lending and financial technology services · Fintech platform · USA
Figure Fintech Lending Platform Breach (2026): 1 Million Borrower Records Including DOB & Home Address Exposed
Fintech company offering home equity, lending, and blockchain-based financial products.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
62/100
Lower riskHigher risk
High and current: recent, valuable data circulating on the dark web now.
Data Sensitivity i
StandardExposed data is largely lower-sensitivity. Standard identity-protection precautions are advised.
1.0MRecords
2026Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
AddressPhysical address
Breach Summary
Figure Technology Solutions, a U.S.-based fintech lending platform best known for digital home equity lines of credit, was breached in January 2026. Data from the platform was publicly posted online in February 2026, with breach-tracking services Have I Been Pwned and DataBreach.com indexing the dataset shortly afterward. Figure confirmed the incident and attributed it to a social-engineering attack in which an employee was tricked into providing access to internal systems.\n\nThe publicly circulating dataset covered approximately 967,000 unique customer records, with HIBP indexing roughly 900,000 unique email addresses. Compromised fields in the public subset included names, dates of birth, email addresses, phone numbers, and physical addresses. State-attorney-general filings, including those with California and Texas authorities, indicated that the underlying breach also exposed Social Security numbers and financial account information for some individuals, beyond the more limited field set published publicly. The threat actor ShinyHunters has been associated with the broader campaign.\n\nFor affected borrowers, the practical risk profile depends on which records were exposed. The publicly circulating subset of name, date of birth, address, and phone number is a strong base for targeted phishing and SIM-swap impersonation, particularly for messages that reference real loan or property relationships. The wider state-filing scope is materially more severe, with Social Security numbers and financial account information supporting fraudulent credit applications and identity-verification bypass at other financial institutions. Affected Figure customers should freeze credit at all three U.S. bureaus, monitor financial accounts closely, and treat any unsolicited contact referencing past loan applications, home equity products, or property records with caution.
Full threat analysis, exploitation vectors, and principal guidance below.
11 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
1.0M records analyzed
About Figure Technology Solutions
Figure Technology Solutions is a U.S.-based fintech lending company headquartered in San Francisco. Founded in 2018 by SoFi co-founder Mike Cagney, the company offers digital home equity lines of credit (HELOCs), mortgage refinancing, and consumer lending products through a fully digital origination process. Figure also operates blockchain-based capital-markets infrastructure used by other lenders to securitize loans. As a regulated lender, the company collects deeply sensitive borrower information during origination, including identity documents, income and employment data, property valuations, credit histories, and bank account verifications used to fund and service loans. The customer base is concentrated in the United States across mortgage and home-equity products.
Why They Hold Your Data
Fintech lending platforms collect borrower identity, financial records, income and employment data, property or asset information, and account activity across loan-origination and servicing workflows.
Recent Developments
Figure publicly disclosed the breach in late February 2026, after data first appeared online and was independently indexed by breach-tracking services. The company attributed the incident to a social-engineering attack in which an employee was tricked into providing access. State filings, including those with the California, Texas, and Maine attorneys general, indicated that some affected records also included Social Security numbers and financial account information beyond the publicly circulating subset. ShinyHunters has been associated with the underlying campaign, consistent with a broader 2025–2026 pattern of identity-based attacks against fintech and financial services firms by the same threat-actor cluster.
Data Points Exposed
5 verified field types
Date of Birth High
Email Address
Full Name
Phone Number
Physical address High
Breach Impact
The institutional impact on Figure is meaningful given the company's positioning at the intersection of consumer lending and capital markets infrastructure. The breach added to a string of recent fintech compromises that has increased regulatory scrutiny on third-party identity controls. State-attorney-general filings disclosed broader field exposure than the publicly circulating subset, including Social Security numbers and financial account information, raising expected costs of customer notification, credit monitoring, and likely class-action exposure. The reputational hit is concentrated among home-equity and mortgage borrowers, an audience that interacts with multiple sensitive financial relationships and weighs trust heavily in lender selection. The Securities and Exchange Commission's Regulation S-P also creates regulatory exposure for affected fintech lenders.
Exploitation & Downstream Threats
• Identity verification bypass using name + date of birth combination | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure
Principal Risk Advisory
What this means for a principal
A financial-institution breach: account, wealth or payment data supports direct fraud and highly credible financial-impersonation scams. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
What You Should Do
- Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
S
Threat Actor: ShinyHuntersConfidence: High
Motivation: Financial extortion, data sale
A prolific data theft and extortion group that began as a database theft and resale actor and evolved toward SaaS-focused extortion. Recent activity involves vishing, credential harvesting, SSO compromise, and theft of customer data from cloud and SaaS environments.
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation