Figure Lending Corp
bd_e98dfc28a35687cb · schema v1 · pii pii-v2
Full breach record for Figure Lending Corp →New American Funding LLC reported a data security incident involving its service provider, Figure Lending, LLC. On January 28, 2026, a Figure employee was targeted by a social engineering attack, resulting in the unauthorized download of files containing personal information (names, addresses, SSNs, DOB, phone, email, loan account numbers) of 131 Nebraska residents. New American Funding's own systems were not affected. Figure notified law enforcement, engaged a cybersecurity firm, and provided 24 months of credit monitoring via TransUnion. New American Funding authorized Figure to notify affected individuals.
J jump to incidentP pin to compareR raw source
Incident timeline
Jan 28, 2026
Begins
Feb 12, 2026
Discovered
Feb 27, 2026
Filed
Linked disclosures
Why this link?Regulatory filings (7) · sorted by filing gap
- California State AGbd_04d4edb44be7c3652026-02-27Candidate
- Washington State AGbd_e5eff25ef061db852026-02-27Verified
- Nebraska State AGbd_7b52ff5445d950f12026-02-24 · +3dVerified
- Massachusetts State AGbd_0e4a9ec64e5867df2026-03-03 · +4dVerified
Show 3 more filings ↓Show fewer ↑up to 7d gap
- Massachusetts State AGbd_16047971769a6e512026-02-23 · +4dVerified
- California State AGbd_296cbbf7363298af2026-02-23 · +4dVerified
- New Hampshire State AGbd_983f209181acda622026-03-06 · +7dVerified
Filing propagation · 8 filings · 5 states
View merged incident ↗Pattern: first filing Feb 23 (MA), last Mar 6 (NH) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.