Cyber Incident Victim: Figure
Date:
Jan 2026
Location:
United States of America
Summary
Figure Lending Corp. experienced a security incident in which personal data was accessed through database queries of loan and inquiry records. The exposed information included names, Social Security numbers, addresses, phone numbers, email addresses, dates of birth, loan account numbers, and loan details affecting nearly one million individuals. A law firm is investigating the breach for potential class action claims related to the compromised data.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On January 28, 2026, Figure Technology experienced an incident where personal data was accessed via database queries involving loan and inquiry records. Figure Lending Corp. discovered that personal information was retrieved by querying company databases containing records of loans and loan inquiries. Following an investigation, they determined that certain personal data may have been acquired, including names, Social Security numbers, addresses, phone numbers, email addresses, dates of birth, loan account numbers, and loan information. The breach affected nearly 1 million users, as indicated in the title of the press release. The incident was disclosed to the public in a press release dated April 9, 2026.
The exposed data places affected individuals at increased risk of identity theft and fraud. Edelson Lechtzin LLP, a national class action law firm, is actively investigating data privacy claims arising from the Figure Lending Corp. data breach. The firm is pursuing a class action seeking legal remedies for individuals whose sensitive personal data may have been compromised. Figure Lending Corp. has undertaken an investigation to determine the scope of the unauthorized access and has notified affected individuals of the breach.
Figure Lending Corp. operates as a fintech firm using blockchain technology to offer quick home equity loans, refinancing, and crypto-backed lending services. The breach involved database queries targeting loan and inquiry records. No further details about attacker identity, method beyond queries, or containment measures are provided in the source material.