Social EngineeringPhishingSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Figure Lending Corp
bd_983f209181acda62 · schema v1 · pii pii-v1
Full breach record for Figure Lending Corp →New American Funding, LLC reported a data security incident involving its third-party service provider, Figure Lending, LLC. On January 28, 2026, a Figure employee was targeted by a social engineering attack, allowing an unauthorized actor to download files containing personal information (names, SSNs, DOBs, loan data). 107 New Hampshire residents were notified on February 24, 2026. Figure offered 24 months of credit monitoring via TransUnion.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_04d4edb44be7c365California State AGfiled 2026-01-28(37d gap)Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/new-american-funding-20260306.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 6, 2026
- Raw hash
- 7227a05e228a4a3266445b62bd97bdf5f554535fe98e480040682f9ff4e028be
Reporting entity
- Name
- NEW AMERICAN FUNDING, LLCnorm: new american funding
- Domain
- newamericanfunding.com
Victim entity
- Name
- Figure Lending Corpnorm: figure lending
Incident
- Discovered
- Feb 12, 2026
- Materiality determined
- —
- Notification sent
- Feb 24, 2026
- Affected individuals
- 107
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified New Hampshire Department of Justice
- Initial access
- phishing_link
Compliance
- Time to disclose
- 22 days(22 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.