Fintech Lender Figure Exposes 967K Customer Records After Social Engineering Attack
What Happened — In February 2026, Figure, a fintech lending platform, confirmed that a social‑engineering attack tricked an employee into granting access to internal systems. The attackers subsequently posted data for 967,178 accounts online, including names, email addresses, phone numbers, physical addresses, and dates of birth.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate employee security awareness – a core control area that continuous‑control‑assurance programs monitor and evidence.
- Highlights the need for strict access‑control policies and real‑time privileged‑access monitoring to provide a defensible audit trail.
- Shows how a single human error can trigger a large‑scale data exposure, underscoring the importance of regular security‑awareness training and testing.
Who Is Affected – Financial services firms, especially fintech SaaS providers and their customers.
Recommended Actions – Review and tighten privileged‑access policies, implement mandatory security‑awareness training focused on social engineering, and deploy continuous monitoring of privileged activity to generate audit‑ready evidence. Source: https://haveibeenpwned.com/api/v3/breach/Figure
Technical Notes – Attack vector: phishing/social‑engineering that led to credential compromise. Exposed data types: dates of birth, email addresses, names, phone numbers, physical addresses. Source: https://haveibeenpwned.com/api/v3/breach/Figure