breach-disclosure-notificationunderground-data-leakmass-credential-exposurefinancial-sector-threat

Figure Data Breach Linked to Employee Social Engineering and ShinyHunters Leak

Breach & Incident Intelligence · 2 sources · Updated 4mo ago · First seen Feb 14, 2026

Figure Technology Solutions, a blockchain-based lending/fintech firm, confirmed a data breach after an employee was socially engineered, enabling attackers to access and exfiltrate a limited number of files. The company said it is communicating with partners and impacted individuals, has begun sending notifications, and is offering free credit monitoring to recipients of breach notices; it has not publicly disclosed the total number of affected individuals or when the incident was detected.

The cybercrime group ShinyHunters claimed responsibility and alleged Figure refused to pay a ransom, publishing about 2.5GB of purportedly stolen data on its leak site. Journalists who reviewed samples reported the exposed data included names, home addresses, dates of birth, and phone numbers, increasing risk of identity fraud and follow-on phishing. ShinyHunters also told reporters the intrusion was part of a broader campaign affecting organizations including Harvard University and UPenn, and referenced victims that rely on Okta for single sign-on.

Is this vendor in your chain?See attribution, scope, and your downstream exposure.

Check the blast radius

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Feb 13, 2026

Feb 13, 20269mo ago
ShinyHunters links Figure incident to broader Okta-focused campaign
A ShinyHunters member told TechCrunch that the Figure breach was part of a wider campaign targeting organizations whose customers use Okta single sign-on. The same claim cited Harvard University and the University of Pennsylvania as other victims.
Feb 13, 20269mo ago
Figure confirms breach and begins notifying affected individuals
Figure publicly confirmed the data breach after receiving media inquiries and said it was working with partners and impacted individuals. The company began notifying affected people and offered free credit monitoring to anyone who receives a breach notice.
Feb 13, 20269mo ago
ShinyHunters claims Figure breach and leaks 2.5GB of alleged data
The threat group ShinyHunters claimed responsibility for the Figure incident, said the company refused to pay a ransom, and posted about 2.5GB of purportedly stolen data on its dark web leak site. Samples reviewed by TechCrunch reportedly contained customer names, home addresses, dates of birth, and phone numbers.
Date unknown
Figure employee is socially engineered, leading to data theft
Figure Technology said attackers socially engineered or phished an employee, which allowed them to access and steal a limited number of files from the company. The company did not disclose when the intrusion was discovered or how many people were affected.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Threat actors

1 linked

ShinyHunters

Organizations

2 linked

Figure Technology Solutions, Inc.Figure

Do you run this?See attribution, scope, and whether this vendor sits anywhere in your supply chain.

Get the Full Incident Picture

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Security AffairsNews · Feb 14, 2026

Fintech firm Figure disclosed data breach after employee phishing attackOpen source ↗

Techcrunch Com SecurityNews · Feb 13, 2026

Fintech lending giant Figure confirms data breach | TechCrunchOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

breach-disclosure-notificationunderground-data-leakmass-credential-exposurefinancial-sector-threat

Figure Data Breach Linked to Employee Social Engineering and ShinyHunters Leak

Breach & Incident Intelligence · 2 sources · Updated 4mo ago · First seen Feb 14, 2026

Is this vendor in your chain?See attribution, scope, and your downstream exposure.

Check the blast radius

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Feb 13, 2026

Feb 13, 20269mo ago
ShinyHunters links Figure incident to broader Okta-focused campaign
A ShinyHunters member told TechCrunch that the Figure breach was part of a wider campaign targeting organizations whose customers use Okta single sign-on. The same claim cited Harvard University and the University of Pennsylvania as other victims.
Feb 13, 20269mo ago
Figure confirms breach and begins notifying affected individuals
Figure publicly confirmed the data breach after receiving media inquiries and said it was working with partners and impacted individuals. The company began notifying affected people and offered free credit monitoring to anyone who receives a breach notice.
Feb 13, 20269mo ago
ShinyHunters claims Figure breach and leaks 2.5GB of alleged data
The threat group ShinyHunters claimed responsibility for the Figure incident, said the company refused to pay a ransom, and posted about 2.5GB of purportedly stolen data on its dark web leak site. Samples reviewed by TechCrunch reportedly contained customer names, home addresses, dates of birth, and phone numbers.
Date unknown
Figure employee is socially engineered, leading to data theft
Figure Technology said attackers socially engineered or phished an employee, which allowed them to access and steal a limited number of files from the company. The company did not disclose when the intrusion was discovered or how many people were affected.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Threat actors

1 linked

ShinyHunters

Organizations

2 linked

Figure Technology Solutions, Inc.Figure

Do you run this?See attribution, scope, and whether this vendor sits anywhere in your supply chain.

Get the Full Incident Picture

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Security AffairsNews · Feb 14, 2026

Fintech firm Figure disclosed data breach after employee phishing attackOpen source ↗

Techcrunch Com SecurityNews · Feb 13, 2026

Fintech lending giant Figure confirms data breach | TechCrunchOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Figure Data Breach Linked to Employee Social Engineering and ShinyHunters Leak

How this story unfolded

ShinyHunters links Figure incident to broader Okta-focused campaign

Figure confirms breach and begins notifying affected individuals

ShinyHunters claims Figure breach and leaks 2.5GB of alleged data

Figure employee is socially engineered, leading to data theft

Related entities

Threat actors

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Figure Technology Solutions Data Breach via Social Engineering

ShinyHunters Expands Data-Extortion Campaigns Across Sectors

ShinyHunters Leaks Donor and Alumni Data Stolen from Harvard and UPenn

Figure Data Breach Linked to Employee Social Engineering and ShinyHunters Leak

How this story unfolded

ShinyHunters links Figure incident to broader Okta-focused campaign

Figure confirms breach and begins notifying affected individuals

ShinyHunters claims Figure breach and leaks 2.5GB of alleged data

Figure employee is socially engineered, leading to data theft

Related entities

Threat actors

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Figure Technology Solutions Data Breach via Social Engineering

ShinyHunters Expands Data-Extortion Campaigns Across Sectors

ShinyHunters Leaks Donor and Alumni Data Stolen from Harvard and UPenn