Figure Technology Suffers Data Breach Affecting Nearly 1 Million Accounts
- Securityish
- Threats & Incidents
Quick Summary
Figure Technology Solutions experienced a data breach affecting nearly 1 million accounts, with hackers stealing personal and contact information through a social engineering attack. The breach, confirmed by a Figure spokesperson, involved the theft of data from 967,200 accounts, including names, email addresses, phone numbers, physical addresses, and dates of birth. This incident highlights significant risks associated with social engineering tactics, particularly in the fintech sector.
The Securityish Brief
Figure Technology Solutions, a blockchain-native fintech company founded in 2018, was breached, leading to the theft of personal and contact information from nearly 1 million accounts. The breach was confirmed on February 13, 2026, when a spokesperson disclosed that attackers had stolen a limited number of files through a social engineering attack. Notification service Have I Been Pwned reported that data from 967,200 accounts was compromised, including over 900,000 unique email addresses, names, phone numbers, physical addresses, and dates of birth.
The ShinyHunters extortion group claimed responsibility for this breach, leaking 2.5GB of data on their dark web site. This incident is part of a broader trend where similar attacks have targeted various organizations, including Canada Goose and Match Group, often involving tactics like voice phishing (vishing) to gain access to sensitive information.
Understanding the Risks of Social Engineering
This breach underscores the growing threat of social engineering attacks, where attackers manipulate individuals into divulging confidential information. In this case, an employee was tricked into providing access, showcasing the vulnerability of human factors in cybersecurity. Organizations must recognize that such tactics can lead to significant data exposure, impacting both user privacy and corporate integrity.
Furthermore, the incident raises concerns about the security measures in place at fintech companies, which often handle sensitive financial data. Users of Figure and similar platforms should be vigilant about their personal information and consider the implications of such breaches on their financial security.
As cyber threats evolve, it is crucial for organizations to implement robust security protocols, including employee training on recognizing social engineering attempts and enhancing multi-factor authentication (MFA) practices. This will help mitigate risks associated with unauthorized access and data breaches.
- Figure Technology Solutions: A fintech firm that suffered a data breach affecting nearly 1 million accounts.
- ShinyHunters: The extortion group that claimed responsibility for the breach and leaked data online.
- Have I Been Pwned: A notification service that reported the extent of the data breach.
- Social Engineering: A tactic used by attackers to manipulate individuals into providing confidential information.
- Vishing: A form of phishing that involves voice calls to trick individuals into revealing sensitive information.
Key Takeaways
- Monitor your accounts for any unusual activity, especially if you have used Figure’s services.
- Consider changing passwords and enabling multi-factor authentication on accounts that may be affected.
- Be cautious of unsolicited communications that ask for personal information, as they may be attempts at social engineering.
- Regularly check if your email or personal information has been compromised using services like Have I Been Pwned.
- Educate yourself and your team about social engineering tactics to better recognize and avoid potential scams.
Key Terms & Concepts
- Social Engineering: In this article, social engineering refers to tactics used by attackers to manipulate individuals into providing confidential information.
- Vishing: In this article, vishing refers to voice phishing attacks where attackers trick individuals into revealing sensitive information over the phone.
- ShinyHunters: In this article, ShinyHunters is the name of the extortion group that claimed responsibility for the data breach at Figure Technology Solutions.
- Have I Been Pwned: In this article, Have I Been Pwned is a notification service that alerts users if their data has been compromised in a breach.
- Fintech: In this article, fintech refers to financial technology companies that provide services using technology, such as Figure Technology Solutions.
Read the original article here: https://www.bleepingcomputer.com/news/security/data-breach-at-fintech-firm-figure-affects-nearly-1-million-accounts/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
