Figure Technology Breach Exposes Data of Nearly 1 Million Customers After Employee Falls to Social Engineering

Quick Facts

• Figure Technology data breach affected 967,200 customers whose names, dates of birth, addresses and phone numbers were stolen
• ShinyHunters hacking group published 2.5 gigabytes of stolen data after Figure refused to pay ransom
• Attack originated when employee fell victim to social engineering scam targeting Okta single sign-on customers

Figure Technology confirmed a data breach affecting nearly one million customers after hackers published stolen information on the dark web. The fintech company said 967,200 unique email addresses were compromised, according to security researcher Troy Hunt who analyzed the leaked data.

The breach began when an employee was tricked in a social engineering attack that allowed hackers to steal customer files. Figure spokesperson Alethea Jadick said the attack let hackers access names, dates of birth, physical addresses and phone numbers.

The ShinyHunters hacking group claimed responsibility and published 2.5 gigabytes of allegedly stolen data after Figure refused to pay a ransom. A ShinyHunters member told TechCrunch that Figure was among victims in a broader campaign targeting customers who use Okta’s single sign-on services. Harvard University and the University of Pennsylvania were also targeted.

Figure first confirmed the breach on February 13. The incident gained wider attention when security site Have I Been Pwned added it to its database February 18, revealing the full scope of affected customers.

The timing proved particularly damaging for Figure, which recently completed its IPO. The company announced a secondary stock offering of over 4 million shares the same day ShinyHunters posted the stolen data. Figure’s stock declined 17.43% over the past week, with shares opening at $34.71 after closing at $36.91.

BofA Securities downgraded Figure from Neutral to Underperform following the breach. Other analysts maintain positive ratings with price targets between $42 and $82.

ShinyHunters has targeted major companies since 2020 and claims 91 successful attacks. The group previously breached AT&T Wireless in April 2024, stealing data on over 110 million customers. AT&T paid a $370,000 ransom in May to delete that data.

Figure said it is communicating directly with affected customers and offering free credit monitoring services. The company stated it continuously monitors accounts and has safeguards protecting customer funds.

Founded in 2018, Figure uses blockchain technology for lending and securities trading. The company has unlocked over $22 billion in home equity through more than 250 partners.

Read more: Data breach at fintech giant Figure affects close to a million customers