Figure figure.com Figure data breach: what happened and what to do
In early 2026, a Figure employee was socially engineered and an attacker downloaded customer files. Have I Been Pwned counts 967,178 accounts with names, email addresses, phone numbers, home addresses and dates of birth. Figure says no Social Security numbers or financial accounts were accessed.
View all 13,115 breaches- Breach date
- 28 Jan 2026
- Made public
- 18 Feb 2026
- Affected
- 967,178
- Data exposed
- Dates of birth, Email addresses, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Figure is a financial technology company that offers home equity lending and other products. Have I Been Pwned (HIBP) dates its breach to January 28, 2026 and added it to its database on February 18, 2026.
What happened
Figure confirmed that an employee had been socially engineered, which means tricked into handing over access. That let an actor download a limited number of files through the employee's account. Reporting says the stolen data was published in mid-February 2026 after the company didn't pay a ransom demand. Figure has said it retained a forensic firm to investigate.
HIBP's copy holds 967,178 accounts, which is the figure this page uses. Figure hasn't publicly given its own count in the sources used here.
What was exposed
HIBP lists these data types:
- Names
- Email addresses
- Phone numbers
- Physical addresses
- Dates of birth
Figure said that no financial account details, Social Security numbers, loan information or customer funds were accessed. A news outlet that reviewed the files said they included full names, home addresses, dates of birth and phone numbers.
What criminals can do with it
This is a well-formed identity kit even without a Social Security number. A name, address, date of birth, phone number and email together are what a criminal needs to pass many basic identity checks, open accounts or take over a phone number.
Because Figure is a lender, scammers also have a ready story. Expect messages that claim to be from Figure or a bank about your loan, your home equity or "suspicious activity", and that quote your real details to sound credible.
Figure's response
Figure started notifying affected people and is offering free credit monitoring to those who get a notice. It said it brought in a forensic firm. The sources used here don't describe a settlement.
Why the date of birth matters
You can change a password. You can't change your date of birth. Combined with your address, it stays useful to criminals for life, which is why the long-term fix is monitoring and a credit freeze, not just one-off password changes.
Serus can't remove breach data from files that have been copied. It monitors breach databases and the dark web for your details, and alerts you if they appear. It can also find the data brokers that list you and ask them to remove you, which makes the same details harder to find elsewhere. The steps below are the ones to do first.
How to check your own exposure
Search your email address on Have I Been Pwned, which is free and doesn't ask for a password. Try any older or secondary addresses too, since people forget the ones they used years ago.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Your name, address and date of birth were exposed. A free freeze at Equifax, Experian and TransUnion blocks new credit being opened in your name. You can lift it temporarily when you apply for credit.
- 2
Accept the free credit monitoring if Figure sends it
Use the code in your notice letter, and check your credit reports for accounts you didn't open.
- 3
Expect scams that mention your loan or bank
Don't act on calls, texts or emails that quote your details. Hang up and call Figure on the number on its official site.
- 4
Add a PIN to your mobile account
With your phone number and personal details exposed, ask your carrier to require a passcode for SIM changes or number transfers.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about new exposures without searching for them.
Frequently asked
Was I affected by the Figure breach?
Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 967,178 accounts. If Figure sent you a notice, you're affected.
What was exposed?
Names, email addresses, phone numbers, home addresses and dates of birth, according to HIBP. Figure said Social Security numbers and financial account details weren't accessed.
Is there a settlement?
None of the sources used for this page report a settlement. Figure is offering free credit monitoring to people it notifies.
Should I change my password?
HIBP doesn't list passwords for this breach. Changing yours isn't required, but a credit freeze is worth doing.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
