Figure Technologies verifies employee-linked data hack - AI News Today Recency

# Figure Technologies Verifies Employee-Linked Data Hack

Figure Technology, a blockchain-based lending company, has confirmed a significant data breach affecting customer information after hackers exploited a social engineering attack targeting an employee account.[1] The incident marks another major cybersecurity incident in the fintech sector, with hackers accessing and publishing sensitive personal data of customers.

How the Breach Occurred

The data breach originated through a social engineering attack that deceived an employee into compromising their account credentials.[1] Once attackers gained access to the employee's account, they were able to download what Figure described as "a limited number of files" from the company's systems. However, the scope of the breach proved more extensive than initial characterizations suggested.

The hacking group ShinyHunters took responsibility for the attack, publishing approximately 2.5 gigabytes of allegedly stolen data on its official dark web leak website.[1] According to ShinyHunters, the group published the data after Figure refused to pay a ransom demand. TechCrunch reviewed portions of the stolen data and confirmed it included customers' full names, home addresses, dates of birth, and phone numbers—sensitive personal information that could facilitate identity theft and fraud.

Connection to Broader Okta Campaign

The breach represents part of a larger hacking campaign targeting customers of Okta, a single sign-on provider.[1] According to ShinyHunters, Figure was among multiple high-profile victims of this coordinated campaign, which also affected Harvard University and the University of Pennsylvania. This connection suggests that attackers exploited vulnerabilities in third-party authentication infrastructure to gain access to multiple organizations simultaneously.

The use of compromised authentication credentials from a trusted provider highlights how attackers can leverage weaknesses in shared security infrastructure to cascade breaches across numerous organizations. This attack pattern underscores the critical importance of securing not only direct company systems but also authentication mechanisms used across vendor ecosystems.

Company Response and Customer Protection Measures

Figure has stated it is "working with partners and those impacted" by the breach and is offering free credit monitoring to all individuals who receive a notice.[1] The company spokesperson, Alethea Jadick, confirmed the breach details in a statement to TechCrunch but declined to provide additional specific information about the scope, timeline, or remediation efforts.

The offer of complimentary credit monitoring represents a standard industry response to data breaches involving personal information. However, critics argue that such measures may be insufficient for protecting customers whose sensitive data—including home addresses and dates of birth—has been publicly disclosed on dark web forums.

Frequently Asked Questions

What specific information was exposed in the Figure Technologies breach?

The stolen data included customers' full names, home addresses, dates of birth, and phone numbers.[1] This combination of information is particularly valuable to identity thieves and could be used for account takeover attempts, fraudulent loan applications, or other forms of identity fraud.

Who was responsible for hacking Figure Technologies?

The hacking group ShinyHunters claimed responsibility for the breach on its official dark web leak website.[1] The group stated that Figure refused to pay a ransom demand, prompting them to publish the stolen data publicly.

How did attackers gain access to Figure Technologies' systems?

Attackers used a social engineering attack to trick an employee into compromising their account credentials.[1] Once they obtained valid employee credentials, they were able to access company systems and download sensitive files.

Is Figure Technologies part of a larger hacking campaign?

Yes, according to ShinyHunters, Figure was targeted as part of a broader campaign affecting customers of Okta, a single sign-on authentication provider.[1] Other victims of the same campaign include Harvard University and the University of Pennsylvania, suggesting attackers exploited vulnerabilities in shared authentication infrastructure.

What is Figure Technologies' response to the breach?

Figure is offering free credit monitoring to all individuals who receive a notice about the breach and stated it is "working with partners and those impacted."[1] However, the company declined to provide additional specific details about the breach scope or remediation timeline.

Should Figure customers be concerned about identity theft?

Yes, customers should exercise heightened caution. The combination of full names, home addresses, dates of birth, and phone numbers disclosed in the breach provides attackers with substantial information for identity theft, account takeover attempts, and other fraudulent activities. Taking advantage of the offered credit monitoring service is advisable, and customers should monitor their financial accounts and credit reports for suspicious activity.