Figure Technology Solutions, a blockchain-based lending company, is facing escalating challenges as it deals with the fallout from a significant data breach. This breach, attributed to the cybercrime group ShinyHunters, has led to the exposure of sensitive personal identifying information (PII) affecting nearly a million customers.
The breach originated from a sophisticated social engineering attack where an employee was deceived, granting unauthorized access to critical systems. As a result, cybercriminals obtained detailed customer data, including names, addresses, dates of birth, and phone numbers. Notably, financial account details do not appear to have been accessed during the breach.
ShinyHunters claimed responsibility for the attack, which was part of a broader campaign targeting users of the Okta single sign-on service. This attack also compromised data from Harvard University and UPenn, among others. After Figure refused to comply with ransom demands, the attackers reportedly released 2.5GB of stolen data online, further intensifying the situation.
Security researcher Troy Hunt, who analyzed the leaked data, identified approximately 967,200 unique email addresses along with the aforementioned personal details. Despite confirming the breach, Figure Technology Solutions has been reticent about detailing the full scope and specific nature of the compromised data.
In response to the breach, legal investigations are now in progress. Security experts advise that the exposure of PII can lead to potential risks such as identity theft, phishing, and account takeover schemes, posing threats long after the initial incident.
This incident underscores the importance of robust security measures and the growing menace of social engineering tactics in exposing sensitive information.

Collections

Figure Technology Solutions, a blockchain-based lending company, suffered a major data breach orchestrated by the cybercrime group ShinyHunters via a social engineering attack. Nearly 967,200 customers had personal information (names, addresses, dates of birth, phone numbers, and email addresses) exposed. The attack was part of a broader campaign targeting Okta SSO users, also affecting Harvard University and UPenn. After Figure refused ransom demands, 2.5GB of stolen data was released publicly. Security researcher Troy Hunt confirmed the breach scope. Financial account details were reportedly not accessed. Legal investigations are now underway, and experts warn of ongoing risks including identity theft and phishing.

Data Breach at Figure Exposes Nearly a Million Customers' Information