Figure Lending data breach: bank account and routing numbers taken in a database query

What happened at Figure?

Figure says it found unauthorized activity on its systems, stopped it, brought in a cybersecurity firm and reported the incident to law enforcement. It says there was no evidence of access to customer accounts or funds, and its operations carried on.

Figure also provides technology and loan administration for partner lenders. So someone whose loan came through one of those lenders can be affected without having borrowed from Figure directly. Washington lists a separate notice from New American Funding, which says Figure Lending had the incident.

Date	What the letter and the regulators' records say
January 28, 2026	Data obtained through database queries
February 23, 2026	Notice recorded by California and Washington (26,128); logged in Massachusetts (146)
February 24, 2026	Indiana's notice date (39,866 total); posted by Texas (323)
February 27, 2026	New American Funding's Washington notice (699), naming Figure Lending
May 31, 2026	Deadline to enroll in the monitoring offer

Notice reached regulators 26 days after the data was taken.

How did hackers get into Figure?

Through an employee, according to the company. A Figure spokesperson told TechCrunch on February 13, 2026 that the breach began when an employee was tricked in a social engineering attack, which let the hackers take a limited number of files. The ShinyHunters group claimed the attack on its leak site. It said Figure had refused to pay a ransom and published 2.5 gigabytes of data it said was stolen. A member of the group told TechCrunch that Figure was one of the victims of a campaign against companies that use Okta for single sign-on. That is the group's account, and Figure has not confirmed it.

How many email addresses were in the Figure leak?

Have I Been Pwned, which loads published breach data so people can check their own address, lists 967.2k email addresses for Figure. It says the data, dating back to January 2026, held over 900,000 unique email addresses along with names, phone numbers, physical addresses and dates of birth. That count covers the published files. It is far larger than any regulator count above (Indiana's total is 39,866), and no document explains the gap. The letters describe bank account and routing numbers being taken, and those fields are not on Have I Been Pwned's list.

Count	What it measures	Number
Have I Been Pwned	Email addresses in the published data	967.2k
Indiana attorney general	People notified in total	39,866
Washington attorney general	Washingtonians notified (Figure notice)	26,128

Were Social Security numbers exposed in the Figure breach?

Figure's letter says no. The state records do not all agree:

Source	Social Security numbers
Figure's letter	Not affected
Washington attorney general (Figure notice)	Listed
Washington attorney general (New American Funding notice)	Listed
Massachusetts consumer affairs office	Marked as breached
Texas attorney general	Listed

The documents do not explain the difference. Anyone whose letter lists only bank details should still watch their bank account, because an account number with its routing number is what the letter says was taken.

How many people were affected?

Regulator	What it counts	Number
Indiana attorney general	Total affected	39,866
Washington attorney general	Washingtonians (Figure notice)	26,128
Washington attorney general	Washingtonians (New American Funding notice)	699
Texas attorney general	Texans	323
Indiana attorney general	Indiana residents	204
Massachusetts consumer affairs office	Massachusetts residents	146

What is Figure offering?

Two years of credit monitoring and identity restoration through TransUnion, with enrollment by May 31, 2026.

Item	Detail from the letter
Provider	TransUnion
Length	Two years
Enrollment deadline	May 31, 2026

The guide to bank, brokerage and mortgage breach notices compares other lenders' letters.

What the documents leave open

• Whether the ShinyHunters claim and the Okta campaign link are accurate; Figure has said only that an employee was tricked.
• Why the Washington, Massachusetts and Texas records list Social Security numbers.
• Which partner lenders' borrowers were affected besides New American Funding's.