HackingFinancial ServicesTechnologyFinanceStolen CredentialsCustomer Data InvolvedData ExfiltratedFinancial accountIdentity (basic)Government IDMediumContained

Figure Lending Corp

bd_16047971769a6e51 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Feb 23, 2026

To disclose

—

Affected

146state residents only

Linked

8 filings

Confidence

64%

Full breach record for Figure Lending Corp →

Figure Lending Corp disclosed a security incident where unauthorized activity on its systems led to the exfiltration of personal information via database queries on January 28, 2026. Affected data includes names, SSNs, addresses, phone numbers, emails, dates of birth, and loan account numbers. The company contained the incident, engaged a cybersecurity firm, notified law enforcement, and is offering two years of credit monitoring through TransUnion. No evidence of unauthorized access to customer accounts or funds was found.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 28, 2026

Begins

Feb 23, 2026

Filed

This filing is one of 8 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_296cbbf7363298af2026-02-23Verified
Nebraska State AGbd_7b52ff5445d950f12026-02-24 · +1dVerified
California State AGbd_04d4edb44be7c3652026-02-27 · +4dCandidate
Washington State AGbd_e5eff25ef061db852026-02-27 · +4dVerified

Show 3 more filings ↓up to 11d gap

Nebraska State AGbd_e98dfc28a35687cb2026-02-27 · +4dVerified
Massachusetts State AGbd_0e4a9ec64e5867df2026-03-03 · +8dVerified
New Hampshire State AGbd_983f209181acda622026-03-06 · +11dVerified

Name: Figure Lending Corp
norm: figure lending
Domain: figure.com

Name: Figure Lending Corp
norm: figure lending
Industry: Financial ServicesllmTechnologyllm

Discovered: —
Breach occurred: Jan 28, 2026
Materiality determined: —
Notification sent: Feb 24, 2026
Affected individuals: 146state-resident count only
Data types: Financial accountIdentity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the incident to law enforcement
Initial access: valid_credentials

During the incident: Acted quickly to stop the activity and enhance our security measures
Began working with a leading cybersecurity firm to investigate what happened
Reported the incident to law enforcement and offered our full cooperation
Offering two years of complimentary credit monitoring and identity restoration services through our third-party vendor, TransUnion
Implemented enhanced security and monitoring controls
Changes made: Implemented enhanced security and monitoring controls
Remain committed to ongoing information security reviews to strengthen our security and privacy programs and controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 5 states

View merged incident ↗

California State AGFeb 23 · first

Massachusetts State AGFeb 23 · first · this page

Nebraska State AG+1d

California State AG+4d

Washington State AG+4d

Nebraska State AG+4d

Massachusetts State AG+8d

New Hampshire State AG+11d

Pattern: first filing Feb 23 (CA), last Mar 6 (NH) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-267-figure-technology-solutions-inc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 23, 2026
Raw hash: 928fb84e8921c3ead3d71f79bba94a885d205bf045502a89a5b71238cf759b55

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityFigure Lending Corp

Victim entityFigure Lending Corp

IncidentUnauthorized Access

Stated responseActed quickly to stop the activity and enhance our security measures

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov