UnknownFinancial ServicesTechnologyFinanceCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Figure Technology Solutions, Inc.

bd_296cbbf7363298af · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Feb 23, 2026

To disclose

—

Affected

Not disclosed

Linked

8 filings

Confidence

65%

Figure Technology Solutions, Inc. (on behalf of Figure Lending Corp and subsidiaries) notified the California AG of a data breach occurring on January 28, 2026. Unauthorized activity resulted in the exposure of names, addresses, bank account numbers, and routing numbers for affected individuals. Social Security Numbers were not involved. The company stopped the activity, engaged a cybersecurity firm, and reported to law enforcement. Two years of credit monitoring via TransUnion are offered.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 28, 2026

Begins

Feb 23, 2026

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Massachusetts State AGbd_16047971769a6e512026-02-23Verified
Nebraska State AGbd_7b52ff5445d950f12026-02-24 · +1dVerified
California State AGbd_04d4edb44be7c3652026-02-27 · +4dCandidate
Washington State AGbd_e5eff25ef061db852026-02-27 · +4dVerified

Show 3 more filings ↓up to 11d gap

Nebraska State AGbd_e98dfc28a35687cb2026-02-27 · +4dVerified
Massachusetts State AGbd_0e4a9ec64e5867df2026-03-03 · +8dVerified
New Hampshire State AGbd_983f209181acda622026-03-06 · +11dVerified

Name: Figure Technology Solutions, Inc.
norm: figure technology
Domain: figure.com

Name: Figure Technology Solutions, Inc.
norm: figure technology solutions
Industry: Financial ServicesllmTechnologyllm

Discovered: —
Breach occurred: Jan 28, 2026
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unknown
Regulator citations: Reported the incident to law enforcement

During the incident: Acted quickly to stop the activity
Enhanced our security measures
Began working with a leading cybersecurity firm to investigate what happened
Reported the incident to law enforcement
Changes made: Offering two years of complimentary credit monitoring and identity restoration services through our third-party vendor, TransUnion
Implemented enhanced security and monitoring controls
Remain committed to ongoing information security reviews to strengthen our security and privacy programs and controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 5 states

View merged incident ↗

Massachusetts State AGFeb 23 · first

California State AGFeb 23 · first · this page

Nebraska State AG+1d

California State AG+4d

Washington State AG+4d

Nebraska State AG+4d

Massachusetts State AG+8d

New Hampshire State AG+11d

Pattern: first filing Feb 23 (MA), last Mar 6 (NH) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-619176
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 23, 2026
Raw hash: 09ca1d3364a7c0d95eb4388c6be8a0dd8dd20c4e75b18c261e021d9ad88fe5e1

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityFigure Technology Solutions, Inc.

Victim entityFigure Technology Solutions, Inc.

IncidentUnknown

Stated responseActed quickly to stop the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov