Figure Lending Corp

New American Funding, LLC reported a data security incident involving its third-party service provider, Figure Lending, LLC. On January 28, 2026, a Figure employee was targeted by a social engineering attack, allowing an unauthorized actor to download files containing personal information (names, SSNs, DOBs, loan data). 107 New Hampshire residents were notified on February 24, 2026. Figure offered 24 months of credit monitoring via TransUnion.

Figure Lending Corp disclosed a security incident where unauthorized activity on its systems led to the obtaining of personal information, including Social Security Numbers, via queries on company databases storing loan and loan inquiry data on January 28, 2026. The company contained the activity, engaged a cybersecurity firm, and notified law enforcement. Affected individuals are offered two years of credit monitoring and identity restoration services through TransUnion.

Figure Lending Corp (and subsidiaries Figure Lending LLC, Figure Markets Credit LLC, Figure Payments Corporation) discovered unauthorized activity on its systems. On January 28, 2026, personal information was obtained through unauthorized queries on company databases storing loan and loan inquiry data. SSNs were not affected for all recipients. The company engaged a cybersecurity firm, notified law enforcement, and is offering 24 months of TransUnion credit monitoring to affected individuals.

Figure Lending, LLC, a service provider for New American Funding, experienced a phishing incident on Jan 28, 2026. An employee was targeted, allowing an unauthorized actor to download files containing customer PII (names, SSNs, DOB, loan data). 699 Washington residents were notified on Feb 24, 2026. Figure engaged forensic investigators, notified law enforcement, and offered 24 months of credit monitoring.

New American Funding LLC reported a data security incident involving its service provider, Figure Lending, LLC. On January 28, 2026, a Figure employee was targeted by a social engineering attack, resulting in the unauthorized download of files containing personal information (names, addresses, SSNs, DOB, phone, email, loan account numbers) of 131 Nebraska residents. New American Funding's own systems were not affected. Figure notified law enforcement, engaged a cybersecurity firm, and provided 24 months of credit monitoring via TransUnion. New American Funding authorized Figure to notify affected individuals.

Figure Lending Corp (subsidiaries Figure Markets Credit LLC and Figure Payments Corporation) notified Nebraska residents of a January 28, 2026 data breach. Unauthorized queries accessed loan and inquiry databases containing names, SSNs, addresses, DOBs, and loan account numbers. No customer account funds were compromised. Figure engaged cybersecurity investigators, notified law enforcement, and provided two years of complimentary credit monitoring via TransUnion.

Figure Lending Corp disclosed a security incident where unauthorized activity on its systems led to the exfiltration of personal information via database queries on January 28, 2026. Affected data includes names, SSNs, addresses, phone numbers, emails, dates of birth, and loan account numbers. The company contained the incident, engaged a cybersecurity firm, notified law enforcement, and is offering two years of credit monitoring through TransUnion. No evidence of unauthorized access to customer accounts or funds was found.

Figure Technology Solutions, Inc. (on behalf of Figure Lending Corp and subsidiaries) notified the California AG of a data breach occurring on January 28, 2026. Unauthorized activity resulted in the exposure of names, addresses, bank account numbers, and routing numbers for affected individuals. Social Security Numbers were not involved. The company stopped the activity, engaged a cybersecurity firm, and reported to law enforcement. Two years of credit monitoring via TransUnion are offered.