Files breach at fintech agency Figure impacts almost 1 million accounts
Cyber investigation
Hackers contain stolen the inner most and accumulate in touch with data of virtually 1 million accounts after breaching the programs of Figure Expertise Solutions, a self-described blockchain-native financial abilities company.
Essentially based in 2018, Figure makes exercise of the Provenance blockchain for lending, borrowing, and securities shopping and selling, and has unlocked over $22 billion in home equity with over 250 partners, along side banks, credit ranking unions, fintechs, and residential improvement companies.
While the blockchain lender didn’t publicly remark the incident, a Figure spokesperson told TechCrunch on Friday that the attackers stole “a limited number of files” in a social engineering assault.
BleepingComputer has additionally reached out to Figure with additional questions in regards to the breach, however a response was no longer at present on hand.
Even supposing the company has yet to fragment how many people had been affected by the guidelines breach, notification service Relish I Been Pwned has now printed the extent of the incident, reporting that recordsdata from 967,200 accounts was stolen in the assault.
“In February 2026, data obtained from the fintech lending platform Figure was publicly posted online,” Relish I Been Pwned stated on Wednesday.
“The exposed data, dating back to January 2026, contained over 900k unique email addresses along with names, phone numbers, physical addresses and dates of birth. Figure confirmed the incident and attributed it to a social engineering attack in which an employee was tricked into providing access.”
The ShinyHunters extortion neighborhood claimed accountability for the breach and added the company to its darkish web leak dilemma, leaking 2.5GB of recordsdata allegedly stolen from thousands of loan applicants.
CaptionFigure Expertise on ShinyHunters leak dilemma (BleepingComputer)
The attackers are impersonating IT toughen, calling their targets’ workers and tricking them into coming into credentials and multi-component authentication (MFA) codes on phishing web sites that impersonate their companies’ login portals.
Once in, they construct accumulate admission to to the sufferer’s SSO story, which provides them with accumulate admission to to other connected enterprise applications and companies, along side Salesforce, Microsoft 365, Google Workspace, SAP, Slack, Zendesk, Dropbox, Adobe, Atlassian, and plenty of others.
As portion of this campaign, ShinyHunters additionally breached on-line dating enormous Match Neighborhood, which owns a pair of standard dating companies, along side Tinder, Hinge, Meetic, Match.com, and OkCupid.
Popular IT infrastructure moves faster than handbook workflows can tackle.
In this unique Tines data, learn the capability your group can decrease hidden handbook delays, toughen reliability by computerized response, and blueprint and scale lustrous workflows on top of tools you already exercise.
