Figure Technology Solutions Data Breach via Social Engineering

Figure Technology Solutions suffered a data breach in which attackers obtained and later publicly posted customer data. Reporting indicates the exposed dataset (dating back to January 2026) included roughly 967,200 accounts / 900k+ unique email addresses, along with names, phone numbers, physical addresses, and dates of birth. Figure confirmed the incident and attributed initial access to social engineering, stating an employee was tricked into providing access and that attackers stole a “limited number of files.”

The ShinyHunters extortion group claimed responsibility and listed Figure on its leak site, alleging the leak included about 2.5GB of data tied to loan applicants. The breach’s scale was corroborated by Have I Been Pwned’s publication of the incident details, while broader coverage noted Figure had not proactively disclosed the incident publicly at the time of reporting and that additional details (e.g., full scope and notification posture) were still emerging.