Blockchain Lender Figure Confirms Customer Data Breach

Figure probes customer data breach as hackers leak files, adding to rising crypto fraud and identity crime concerns.

Figure Technology, a blockchain-based lending company, has confirmed a data breach following a social engineering attack. Hackers gained access after tricking an employee and stole a limited number of files. Company representatives say outreach to affected parties is underway.

Figure Investigates Data Leak as Hackers Release Stolen Files Online

Figure spokesperson Alethea Jadick said attackers obtained “a limited number of files” after deceiving an employee. The company is contacting partners and anyone who may be affected and offering free credit monitoring to those who receive a notice.

Notably, lending records contain sensitive personal details, including names, home addresses, dates of birth, Social Security numbers, income documents, and bank details. Even a portion of this data can be enough for identity theft, financial fraud, or targeted scams. However, Figure has not yet specified which types of information may have been exposed.

Cybercrime group ShinyHunters claimed it was behind the attack and posted stolen data on its dark web site. The group said Figure refused to pay a ransom and therefore released about 2.5 gigabytes of data online. TechCrunch reviewed part of the leak, which included customer names, home addresses, dates of birth, and phone numbers.

A member of ShinyHunters said the campaign focused on companies using Okta, a service that manages login access. Reported victims also include Harvard University and the University of Pennsylvania.

ShinyHunters uses a method called “double extortion.” First, hackers break in and copy private data. Then they demand money and threaten to publish that data if they are not paid. Security researchers say attackers exploit weak passwords, third-party services, or poorly secured online storage systems.

Data Breaches Impact Millions as Financial Sector Faces Rising Threats

Financial companies are frequent targets of data theft and extortion because they store sensitive personal data. Information such as names, addresses, and ID numbers can be sold or used for fraudulent purposes.

A Chainalysis report found that criminals stole more than $17 billion in crypto last year. Many of those thefts involved scammers impersonating trusted individuals or companies. According to the report, criminals sometimes use artificial intelligence to make their messages appear authentic.

Cyberattacks remained widespread in 2025, with reports showing that large-scale data breaches continued to affect millions of people. Privacy Rights Clearinghouse reports show that regulators received more than 8,000 breach notifications.

Those filings were linked to over 4,000 separate hacking incidents. In total, at least 374 million people had some of their personal information exposed.

Moreover, Figure recently revealed plans to sell up to 4,230,000 additional shares to investors. Companies often sell shares to raise money for operations or future growth. Figure also stated it may buy back up to $30 million worth of another class of its stock from the financial firms managing the sale.

At the time of writing, Figure’s stock price rose 3.57% on Friday, closing at $35.29. Even with that daily gain, shares are still down 37% over the past month, indicating a sharp decline in value.