HackingFinancial ServicesTechnologyFinanceCapture Stored DataData ExfiltratedCustomer Data InvolvedPIIFinancialLowContained

Figure Lending Corp

bd_04d4edb44be7c365 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Feb 27, 2026

To disclose

—

Affected

Not disclosed

Linked

8 filings

Confidence

77%

Full breach record for Figure Lending Corp →

Figure Lending Corp (and subsidiaries Figure Lending LLC, Figure Markets Credit LLC, Figure Payments Corporation) discovered unauthorized activity on its systems. On January 28, 2026, personal information was obtained through unauthorized queries on company databases storing loan and loan inquiry data. SSNs were not affected for all recipients. The company engaged a cybersecurity firm, notified law enforcement, and is offering 24 months of TransUnion credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 28, 2026

Begins

Feb 27, 2026

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Washington State AGbd_e5eff25ef061db852026-02-27Verified
Nebraska State AGbd_e98dfc28a35687cb2026-02-27Verified
Nebraska State AGbd_7b52ff5445d950f12026-02-24 · +3dVerified
Massachusetts State AGbd_0e4a9ec64e5867df2026-03-03 · +4dVerified

Show 3 more filings ↓up to 7d gap

Massachusetts State AGbd_16047971769a6e512026-02-23 · +4dVerified
California State AGbd_296cbbf7363298af2026-02-23 · +4dVerified
New Hampshire State AGbd_983f209181acda622026-03-06 · +7dVerified

Name: NEW AMERICAN FUNDING, LLC
norm: new american funding
Domain: newamericanfunding.com

Name: Figure Lending Corp
norm: figure lending
Industry: Technology-driven lender; home equity lines of credit, refinancing, crypto-backed loans
Industry: Financial ServicesllmTechnologyllm

Discovered: —
Breach occurred: Jan 28, 2026
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIFinancial
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: External
Regulator citations: Reported the incident to law enforcement and offered full cooperationNotification submitted to California Office of the Attorney General

During the incident: Acted quickly to stop the activity and enhance our security measures
Began working with a leading cybersecurity firm to investigate what happened
Reported the incident to law enforcement and offered our full cooperation
Established a dedicated call center to answer questions about the security incident
Offering two years of complimentary credit monitoring and identity restoration services through TransUnion
Changes made: Implemented enhanced security and monitoring controls
Committed to ongoing information security reviews to strengthen our security and privacy programs and controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 5 states

View merged incident ↗

Massachusetts State AGFeb 23 · first

California State AGFeb 23 · first

Nebraska State AG+1d

Washington State AG+4d

Nebraska State AG+4d

California State AG+4d · this page

Massachusetts State AG+8d

New Hampshire State AG+11d

Pattern: first filing Feb 23 (MA), last Mar 6 (NH) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-619492
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 27, 2026
Raw hash: 2b8aaf6419bf8dae986472248147d19971a3c99743fa3538fc451ad342f84ea3

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityNEW AMERICAN FUNDING, LLC

Victim entityFigure Lending Corp

IncidentUnauthorized Access

Stated responseActed quickly to stop the activity and enhance our security measures

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov