Employee Compromise at Figure Technology Solutions Affected 967,000 Accounts

Figure Technology Solutions reported an incident affecting around 967,000 user accounts, following social engineering of an employee, with about 2.5 GB of data subsequently leaked.

The vector is the year’s standard one and needs little further comment. The data class is worth separating out.

To decide whether to lend, a platform must establish identity, income, employment and existing obligations. That means government identification, pay records, bank statements and credit information, assembled in one place, for every applicant — including those who were declined.

Very few other commercial relationships require that combination. A retailer holds what you bought; a lender holds what you earn, what you owe and who you are, verified against documents.

A person who applied and was declined has no ongoing relationship, may not remember applying, and is unlikely to be watching for a notification. Their file is nonetheless complete, because the assessment required it before the decision was made.

Retention of declined applications is the control that would bound this, and it is set by whichever consideration argued loudest — usually the possibility of re-application, or a regulatory record-keeping obligation read expansively.