Overview
- Troy Hunt’s Have I Been Pwned identified 967,200 unique email addresses in the dataset, alongside names, dates of birth, postal addresses, and phone numbers.
- ShinyHunters claimed responsibility and published roughly 2.5GB of stolen Figure data on its leak site on February 13.
- Figure says an employee was socially engineered, allowing access to a limited number of files, and attributes the intrusion to a credential-harvesting tactic.
- The company reports it blocked the activity, engaged an external forensic firm, began notifications, and is offering complimentary credit monitoring to those alerted.
- The breach surfaces during a sensitive period for the Nasdaq-listed lender following its IPO and a secondary stock offering process.