In February 2026, fintech lender Figure confirmed a breach that exposed around 967,000 customer records. The entry point wasn't a software flaw. Attackers used voice phishing to trick an employee and slip into the company's single-sign-on environment. The exposed data included names, dates of birth, email and postal addresses, and phone numbers. Figure stated that Social Security numbers, financial account numbers, and loan details weren't part of the leak.
Even without those, that's a rich kit for follow-on phishing and identity fraud aimed at customers.
The takeaway for any business: your login screen is often less exposed than your staff. Attackers increasingly just call and ask. Train your team to expect that, and require a second channel to verify any urgent request for access or credentials. Turn on phishing-resistant multi-factor authentication, limit how much data any single account can reach, and make it normal, not awkward, for an employee to pause and confirm before granting access.
Further reading: original source ↗
Want this handled for you?
This is exactly the kind of thing our website security work takes off your plate. Start with a free, no-pressure look at your site.
Come aboard