Figure Technology Data Breach Lawsuit: Loan Records Taken, Lawsuit Filed, No Settlement
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
On January 28, 2026, someone pulled personal data out of the loan databases of Figure, the blockchain-based home-equity and crypto-backed lender. The notice letters say it included names, Social Security numbers, dates of birth and loan account details. A proposed federal class action was filed in Charlotte on February 19, 2026, and its docket later shows a notice of voluntary dismissal. As of October 2026 we found no settlement, no fund and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened in the Figure Technology Data Breach
Figure confirmed the incident on February 13, 2026, telling TechCrunch that an employee was tricked in a social engineering attack that let the intruders take “a limited number of files.” A hacking group claimed responsibility, said Figure refused to pay a ransom, and published what it described as 2.5 gigabytes of stolen data.
The notice letters, dated February 24, 2026, are more specific. They say data was obtained on January 28, 2026 “through queries on company databases that store loan and loan inquiry data,” and list name, Social Security number, address, phone number, email, date of birth, loan account number and loan information. Figure says there was no evidence of access to customer accounts or funds.
The letters come from Figure Lending Corp and its subsidiaries Figure Lending LLC, Figure Markets Credit LLC and Figure Payments Corporation. Figure also services loans for partner lenders, so you may have been notified even if your loan was with another company.
Case Details
The lead case is Mardikian v. Figure Lending, LLC, No. 3:26-cv-00135, filed February 19, 2026 in the U.S. District Court for the Western District of North Carolina, Charlotte Division, and assigned to Judge Kenneth Davis Bell Sr. Figure Lending is headquartered in Charlotte. The complaint alleges that Figure failed to adequately train employees on cybersecurity and failed to maintain reasonable safeguards, and it also pleads obligations under the Gramm-Leach-Bliley Act. These are allegations; no court has ruled on them. The docket lists a Notice of Voluntary Dismissal filed in late June 2026. We could not read it, so we cannot say whether the case was dropped, refiled elsewhere or limited to some parties.
Federal dockets show other 2026 proposed class actions against Figure Technology Solutions, Inc., including Leach, No. 2:26-cv-00943 (D. Nev., filed March 27, 2026) and Arabian, No. 2:26-cv-01008 (D. Nev., filed April 1, 2026). We could not confirm from the dockets alone that these concern the breach.
Status: No Settlement; Mardikian Voluntary Dismissal Noticed
In the Nevada cases, Figure asked for and received more time to respond; in Arabian, its answer was due July 30, 2026. Anything advertising a “Figure settlement claim” is describing something that does not exist yet.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is Covered by the Figure Technology Data Breach Lawsuit
The Mardikian complaint proposes a nationwide class of people whose information was compromised in the breach. You do not sign up for a class action; if a class is certified or a settlement is reached, an administrator notifies class members.
How many people? Figure has not published a nationwide total that we could verify from a government filing. Washington’s attorney general lists 26,128 Washington residents notified by Figure Technology Solutions, plus 699 more notified through New American Funding, a partner lender. Have I Been Pwned counts 967,200 email addresses in the leaked data, which is a count of email addresses, not of people notified.
Your letter is the test. Keep it: it shows what was taken and is your proof of membership.
Is There Money From the Figure Technology Data Breach?
What Figure did offer was two years of TransUnion credit monitoring and identity restoration, but the enrollment deadline in the letter was May 31, 2026, and the letter says the code stops working after that date. For how comparable breach cases have paid when they did settle, see the data breach settlement calculator. Be careful with quoted numbers: as our Sling TV report showed, a widely repeated figure can come from a statute rather than a payout.
How cases like this one end
Our copy of the federal courts’ own case database covers 83,315 other statutory actions casesclosed in U.S. federal district courts between 2015 and 2026, 11.8% of them filed as class actions:
- 25.6% ended in a settlement recorded by the court. Another 22.4% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 25.6% and 47.9%.
- 7.4% were decided on a motion before any trial.
- 1 in 156 reached a trial (0.6%), after a median of 21.8 months.
- Median time from filing to the end of the case: 4.9 months.
- Only 1,756 of them (2.1%) record a money award at all; the median of those is $199,500.
These are base rates for this type of case (federal other statutory actions cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
Figure Technology Data Breach Timeline
- 1
January 28, 2026 — Data Taken
Per the notice letters, personal data is obtained through queries on Figure databases that store loan and loan inquiry data.
- 2
February 13, 2026 — Figure Confirms
Figure tells TechCrunch an employee fell for a social engineering attack. A hacking group claims the attack and posts data it says was stolen.
- 3
February 19, 2026 — First Class Action
Mardikian v. Figure Lending, LLC, No. 3:26-cv-00135, is filed in the Western District of North Carolina.
- 4
February 23–24, 2026 — Notices Go Out
Figure Technology Solutions reports 26,128 affected Washington residents to that state on February 23. The letters to individuals are dated February 24.
- 5
May 31, 2026 — Monitoring Enrollment Closes
Last day to activate the two years of free TransUnion monitoring offered in the letter.
- 6
October 2026 — No Settlement
The Mardikian docket shows a notice of voluntary dismissal from late June 2026, and the Nevada cases were still open when we last checked. No fund, no administrator, no claim form and no deadline exist.
Three Things to Watch For
This breach exposed loan details as well as identity data, which gives scammers useful material:
Calls or emails from your “loan servicer”
The stolen fields included loan account numbers and loan information. A message quoting your HELOC details and asking you to change where payments go, or to “verify” your Social Security number, should be checked by calling the number on your own statement.
“Activate your Figure credit monitoring” offers
The real letter came from Figure Lending Corp c/o Cyberscout, P.O. Box 3826, Suwanee, GA, with a call center at 1-855-522-6935, and enrollment closed May 31, 2026. A new “activation” link sent today is not from that program.
“Claim your Figure settlement” pages
There is no settlement and no claim portal. A page asking for your Social Security number or a fee to “secure your payment” is collecting data, not filing a claim.
Figure Technology Data Breach — Questions People Actually Ask
Is there a Figure Technology data breach lawsuit?
Yes. Mardikian v. Figure Lending, LLC, No. 3:26-cv-00135, was filed February 19, 2026 in the Western District of North Carolina as a proposed class action. Its docket later shows a Notice of Voluntary Dismissal filed in late June 2026, and we found no settlement.
What data was exposed in the Figure Technology data breach?
Per the notice letters: name, Social Security number, address, phone number, email, date of birth, loan account number and loan information. Figure says there was no evidence that customer accounts or funds were accessed.
How many people were affected?
Figure has not published a total that we could verify. Washington’s attorney general lists 26,128 Washington residents. Have I Been Pwned counts 967,200 email addresses in the leaked data; that is not an official count of people notified.
Are data breach settlements legit, and is there one for Figure?
Real settlements exist. They are approved by a court and run by a named administrator, and you never pay to file. For Figure there is no settlement yet, so any “Figure claim” site asking for your details is not legitimate. Our open settlements list shows which breach settlements are taking claims now.
I got a letter but my loan isn’t with Figure. Is it real?
It can be. Figure says it also services and originates loans for partner lenders. Washington records include a separate notice from New American Funding about the same incident. Check the letter against the return address and call-center number listed above.
Can I still get the free credit monitoring?
The letter set an enrollment deadline of May 31, 2026, and says the code stops working after that date. You can still freeze your credit at Equifax, Experian and TransUnion yourself for free.
Do I have to do anything to join the lawsuit?
No. If a class is certified or a settlement is reached, class members are notified with instructions. Keep your notice letter and records of any fraud or costs you can tie to the breach.
What is worth doing right now?
Freeze your credit, which is free and reversible. Watch for messages that quote your loan details, and verify them by calling the number on your own statement, not the number in the message.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements taking claims right now, with deadlines
Data Breach Settlement Calculator
What comparable breach settlements have paid per person
loanDepot Data Breach Settlement
Another lender breach, and how that case resolved
Class Action Payout Calculator
Estimate a per-person share once a fund exists