Figure Technology discloses data breach after social engineering attack

A cybersecurity incident has impacted Figure Technology, a blockchain based lending company, after hackers gained access to company data. A company spokesperson confirmed to a publication that the breach occurred when an employee was targeted through a social engineering attack, which allowed attackers to steal “a limited number of files.”

In a statement shared on Friday, spokesperson Alethea Jadick said the company is communicating “with partners and those impacted,” and is offering free credit monitoring “to all individuals who receive a notice.” The spokesperson did not respond to several detailed questions about the nature and scope of the breach.

The hacking group ShinyHunters claimed responsibility for the attack on its official dark web leak site. The group alleged that Figure refused to pay a ransom and published 2.5 gigabytes of what it said was stolen data. A publication reported that it reviewed part of the leaked information, which included customers’ full names, home addresses, dates of birth, and phone numbers.

A member of ShinyHunters told the publication that Figure was among several organisations targeted in a broader hacking campaign aimed at customers using the single sign on provider Okta. Other reported victims of the same campaign include Harvard University and the University of Pennsylvania. The incident highlights ongoing cybersecurity risks for fintech companies and institutions relying on third party authentication services.