Fintech lending giant Figure confirms data breach

Figure Technology, a prominent player in blockchain-based lending, has publicly acknowledged a data breach incident. According to a statement from spokesperson Alethea Jadick, the breach was a result of a social engineering attack that deceived an employee, enabling hackers to access a limited number of files. In response to the breach, Figure is actively collaborating with both partners and affected individuals, offering complimentary credit monitoring services to those impacted by the incident. However, the spokesperson did not address specific inquiries regarding the details of the breach. The hacking group ShinyHunters has claimed responsibility for the attack, stating on their dark web leak site that Figure declined to pay a ransom. They proceeded to release 2.5 gigabytes of what they allege to be stolen data. A portion of this data, reviewed by TechCrunch, reportedly includes sensitive information such as full names, home addresses, dates of birth, and contact numbers. A representative from ShinyHunters indicated that Figure was part of a broader hacking campaign targeting users of the single sign-on provider Okta, with notable victims including prestigious institutions like Harvard University and the University of Pennsylvania.