The news: Fintech lender Figure suffered a data breach caused by social engineering that affected nearly 1 million customers. Records exposed included names, dates of birth, physical addresses, phone numbers, and email addresses.

How it works: Figure focuses on home equity lines of credit (HELOCs), offering a digital alternative to traditional application and approval. It originates and sells its own loans to institutional investors. Financial institutions partner with Figure to distribute their products. Figure operates a blockchain for the origination, funding, and sale of its credit assets.

Zoom out: Data breaches in financial services aren’t shocking, and Figure’s breach was relatively small.

• SitusAMC, a vendor to major banks, experienced a data breach In November tied to residential mortgages and may have included personally identifiable information.
• Mortgage lender LoanDepot reported a ransomware attack in 2024 that affected 16.9 million people.
• Evolve Bank & Trust, a fintech partner bank, disclosed a data breach in 2024 that affected about 7.6 million people.
• Debt collector Financial Business & Consumer Solutions reported a data breach in 2024 that exposed about 4.2 million customers.

Implications for banks: Figure made a brief statement about the breach to the press, but that was it. Data breaches are a customer trust problem for any financial services provider. Banks would be wise to have a crisis plan that allows them to be honest with their customers. According to our January 2026 report US Banking Consumer Trust 2026, trust hinges on integrity, ethics, and data security.

• Our survey noted that 74.3% of respondents said knowing their personal data is safe and secure is extremely valuable, and 74.3% said knowing they’re “being protected from fraud is extremely valuable.
• Consumers acquire the vast majority of their deposit products through their primary bank: 85.1% for checking accounts and 82.1% for savings. But only 34.3% get their HELOC through their primary bank.