Fintech lender Figure confirms breach after ShinyHunters leaks customer data
Figure Technology, a U.S. lending company that uses blockchain to process home equity and other loans, confirmed a data breach on Feb. 13 after the ShinyHunters extortion group published data it said was stolen from the company, TechCrunch reported.
Figure went public on the Nasdaq in September 2025. The breach is another example of a campaign in which attackers phone employees, pose as IT staff and talk their way into company cloud accounts.
What happened
A Figure spokesperson said an employee was tricked in a social engineering attack and that the hackers took a limited number of files. The company said it was communicating with partners and affected people and would offer free credit monitoring to everyone who receives a notice. It did not answer detailed questions.
ShinyHunters listed Figure on its leak site, said the company refused to pay a ransom and published 2.5 GB of data. TechCrunch reviewed part of it and found customers' full names, home addresses, dates of birth and phone numbers. A member of the group said Figure was among the victims of a campaign targeting customers of the single sign-on provider Okta; Figure has not confirmed that link.
Have I Been Pwned added the data on Feb. 18 and counted about 967,000 affected email addresses, with names, dates of birth, phone numbers and physical addresses. It dates the breach to January 2026.
How the campaign works
Google's threat intelligence group has described the wider campaign: callers claim to be updating multi-factor settings, send employees to fake company-branded sign-in pages to capture passwords and one-time codes, register their own device and then export data from cloud apps. Other victims named by the group include Harvard University and the University of Pennsylvania.
What to do
Figure customers should watch for loan or refinancing scams that use their real address and birth date, and contact Figure only through its official website. Companies can blunt this technique with phishing-resistant multi-factor authentication such as security keys or passkeys.
