Close to one million user records have been compromised following a cybersecurity incident at Figure Technology Solutions, a blockchain-powered lending firm.
The Nasdaq-listed fintech company confirmed to TechCrunch that it experienced a data breach after an employee was targeted in a social engineering attack. According to the company, attackers were able to access a limited set of internal files as a result of the incident.
The cybercriminal group ShinyHunters has claimed responsibility for the breach. On its Tor-based leak site, the group published more than 2.4GB of archived files, allegedly containing data exfiltrated from Figure’s systems.
Data breach monitoring platform Have I Been Pwned analyzed the leaked material and identified approximately 967,000 unique user records tied to Figure.
The exposed information reportedly includes full names, dates of birth, email addresses, postal addresses, and phone numbers — details that could potentially be exploited in identity theft or phishing campaigns.
Figure Technology Solutions specializes in blockchain-based home equity lending and mortgage services. As a publicly traded company on Nasdaq, the breach raises fresh concerns about cybersecurity risks within the fintech sector.
ShinyHunters told TechCrunch that Figure is among several organizations affected by a broader wave of attacks linked to a recent Okta-related campaign. The campaign allegedly involved voice phishing tactics designed to compromise single sign-on (SSO) accounts, enabling attackers to gain access to sensitive corporate data.
Other companies reportedly impacted in the same campaign include Betterment, Crunchbase, and Panera Bread.
The full scope of the breach and whether affected users will receive additional notifications or remediation support remains to be seen.
