Figure Technology, a company specializing in blockchain-based lending, has acknowledged a data breach affecting its systems. The incident was confirmed on Friday by company spokesperson Aleteya Jadik, who detailed that social engineering tactics were employed against an employee, enabling attackers to extract “a limited number of files.”
“a limited number of files.”
In response to the breach, Figure Technology is collaborating with its partners and those impacted by the incident to address the situation. They are also offering complimentary credit monitoring services to all individuals notified about the breach.
Incident Overview and Ongoing Actions
While Jadik refrained from providing specific answers to concerns regarding the breach, it was noted that the hacker group ShinyHunters has claimed responsibility. In a post on their official dark web site, they alleged that Figure declined to pay a ransom demand and subsequently released 2.5 gigabytes of what they purport to be stolen data. This data reportedly includes sensitive information such as full names, home addresses, dates of birth, and phone numbers of customers.
TechCrunch has examined portions of the leaked data, confirming its authenticity, and further reported that ShinyHunters stated Figure was part of a broader campaign targeting customers using the Okta single sign-on service. Prominent educational institutions, including Harvard University and the University of Pennsylvania, have also reportedly fallen victim to this campaign.
“to all individuals who will receive notifications.”
This incident highlights critical vulnerabilities often associated with social engineering, which falls under the MITRE ATT&CK framework’s category of initial access tactics. Attackers use deceptive methods to manipulate individuals into divulging confidential information or granting access. The event underscores the importance of reinforcing employee training on recognizing and resisting social engineering attempts.
The breach also raises larger concerns surrounding digital security measures employed by organizations, particularly those harnessing single sign-on technologies. Ensuring robust security protocols, monitoring for unauthorized access, and adhering to best practices in incident response are vital for safeguarding against similar attacks in the future. As businesses navigate an increasingly digital landscape, maintaining vigilance against potential vulnerabilities becomes imperative.