Figure Lending Corp recently disclosed a data security incident involving unauthorized activity on its systems. The incident involved database queries that obtained certain personal information associated with loan and loan inquiry data stored by the company.
Figure Lending’s Data Breach Investigation
Figure Lending Corp, along with its subsidiaries Figure Lending LLC, Figure Markets Credit LLC, and Figure Payments Corporation (collectively referred to as “Figure”), recently notified individuals about a cybersecurity incident involving unauthorized activity within its systems.
Figure is a technology-driven financial services company known for providing blockchain-enabled home equity lines of credit, refinancing services, and crypto-backed loans. In addition to originating loans, the company also offers technology infrastructure and loan administrative services to partner lenders and financial institutions. Because of these services, the company maintains loan-related information tied to borrowers and individuals who have made loan inquiries.
According to the company’s notice, Figure identified suspicious activity within its systems and immediately took steps to stop the activity. After discovering the issue, the organization initiated an incident response process and began working with a leading cybersecurity firm to investigate what had occurred.
The company also reported the incident to law enforcement authorities and stated that it is cooperating fully with investigators as part of the ongoing review.
Through the investigation, Figure determined that unauthorized activity involved database queries that accessed information stored in systems containing loan and loan inquiry data. Investigators concluded that on January 28, 2026, data containing personal information was obtained through these queries.
Database queries are commonly used by organizations to retrieve information from internal systems. However, if these queries are executed by unauthorized individuals or malicious actors, they can be used to extract sensitive information from large datasets. In incidents like this, attackers may attempt to collect personal information for fraudulent purposes or identity theft.
Figure reported that the unauthorized queries resulted in the acquisition of certain personal information related to individuals connected to loan applications or inquiries. However, the company stated that there was no evidence that attackers accessed customer accounts directly or compromised funds associated with those accounts.
According to the company, its financial systems include strong safeguards designed to protect customer funds and accounts. Figure also stated that it continuously monitors account activity and that business operations were not disrupted as a result of the incident.
Even though there was no indication that accounts or funds were accessed, the exposure of personal information can still present risks for individuals whose data was involved. Cybercriminals may attempt to use personal data in identity theft schemes, phishing attacks, or other forms of fraud.
Following the discovery of the incident, Figure implemented additional security and monitoring controls designed to strengthen the protection of its systems. The company also reported that it is continuing to review and enhance its cybersecurity and privacy programs.
In addition to improving security measures, Figure began notifying individuals whose information may have been obtained through the unauthorized database queries. The company stated that affected individuals are being offered complimentary credit monitoring and identity restoration services through TransUnion.
These services are intended to help individuals monitor their credit activity and detect potential signs of identity theft or fraudulent use of their personal information.
Data breaches involving financial technology companies can raise concerns because these organizations often maintain sensitive personal and financial data as part of their lending and loan servicing activities. As a result, individuals who receive notification that their information may have been involved in a data breach may want to remain vigilant and stay informed about steps they can take to protect themselves.
When Did This Breach Occur?
According to the company’s investigation, the unauthorized activity that led to the data exposure occurred on:
January 28, 2026
On that date, investigators determined that data containing personal information was obtained through unauthorized database queries involving systems that store loan and loan inquiry information.
What Information Was Breached?
Figure reported that certain personal information associated with loan or loan inquiry records may have been obtained. The specific data elements involved may vary by individual, but may include:
-
Personal information associated with loan records or loan inquiries
The company stated that Social Security numbers were not affected by the incident.
What You Can Do
If you received a data breach notification from Figure Lending, there are several steps you may consider taking to help protect your personal information.
First, consider enrolling in the complimentary credit monitoring and identity restoration services offered through TransUnion. These services can help you monitor your credit activity and alert you to potential signs of identity theft or fraudulent account activity.
It is also important to regularly review your financial accounts and credit reports. Monitoring these records can help you quickly identify unauthorized transactions or suspicious changes to your credit file.
If you notice unfamiliar activity, you should report it immediately to your financial institution or the appropriate credit reporting agency.
You may also consider placing a fraud alert or credit freeze on your credit file with the major credit bureaus. These measures can help prevent new credit accounts from being opened in your name without your authorization.
Many individuals who receive data breach notifications do not realize that they may have legal rights when their personal information is exposed due to inadequate cybersecurity protections. Understanding your options and seeking guidance can help you determine whether further action may be appropriate.
File a Data Breach Lawsuit Against Figure Lending
If you received a notice stating that your personal information may have been involved in the Figure Lending data breach, you may have legal rights. Companies that collect and store sensitive personal data have a responsibility to implement strong cybersecurity protections to safeguard that information.
When those protections fail and personal information becomes exposed, affected individuals may be able to pursue compensation through a data breach lawsuit. Legal claims may seek damages related to risks of identity theft, time spent monitoring accounts, and other potential harms associated with data exposure.
Class action lawsuits allow individuals affected by the same data breach to join together to hold organizations accountable for failing to properly protect sensitive information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.