Figure
Closing the account does not close the file. Money-laundering and tax rules keep your identity and transaction records for years, and a permission to share your data wherever the law allows covers much of the rest. The holds set by statute are the ones no request can move.
Reported incidents
Nearly a million customers' details taken after an employee was tricked
2026-02-13Figure Technology, a US lender best known for home equity lines of credit, confirmed on 13 February 2026 that hackers took "a limited number of files" after a social engineering attack on an employee's account. The group ShinyHunters claimed the theft and published about 2.5 gigabytes of data after Figure declined to pay. The files held customers' names, home addresses, dates of birth and phone numbers. On 18 February Troy Hunt of Have I Been Pwned reported 967,200 unique email addresses in the data. Figure said it was offering credit monitoring to people it notified.
People affected typically ask Figure to confirm whether their information was included, and which categories.
The verified route
DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply.