The New American Funding, LLC (Figure Lending, LLC had incident) Data Breach: Reported Filing Facts

In 2026, a security incident impacting Figure Lending, LLC was formally reported to the Washington Attorney General, highlighting escalating vulnerabilities within financial technology and digital lending platforms. Breaches affecting financial institutions typically involve sophisticated cyberattacks, unauthorized network intrusion, third-party vendor compromises, or exploitation of system vulnerabilities that expose internal databases housing customer files. Given the interconnected nature of modern mortgage origination—where third-party service providers, cloud storage environments, and automated underwriting systems constantly exchange data—an intrusion can quickly compromise sensitive repositories before security teams are able to contain the threat.

The exposure of financial and identity data in an incident of this nature carries severe, long-term risks for affected consumers. When records containing names, Social Security numbers, banking details, and credit profiles are accessed by unauthorized actors, victims face an immediate and elevated threat of identity theft, financial account takeover, and fraudulent loan applications. Unlike transient retail breaches where payment cards can simply be replaced, the compromise of core identity markers and historical financial records exposes individuals to prolonged risks of synthetic fraud, tax return tampering, and unauthorized credit inquiries that can damage financial standing for years.

Financial institutions like New American Funding and Figure Lending are bound by rigorous federal and state regulatory frameworks, most notably the Gramm-Leach-Bliley Act (GLBA) and the Washington My Health My Data Act or state consumer protection statutes, which mandate strict administrative, technical, and physical safeguards to protect non-public personal information. Under these legal standards, institutions have an affirmative duty to maintain robust encryption, conduct continuous network monitoring, and vet third-party vendor security practices. The occurrence of a significant data breach strongly suggests potential failures in fulfilling these statutory obligations, raising serious questions regarding whether adequate cybersecurity measures were implemented to thwart unauthorized access.

Receiving an official data breach notification letter from the company serves as formal legal acknowledgment that your private information was compromised due to inadequate security infrastructure. Under established legal principles, this notification establishes the necessary legal standing to participate in a class action lawsuit aimed at holding the responsible parties accountable. Affected individuals do not need to prove that they have already suffered actual financial loss or identity theft to seek legal redress; the increased risk of future harm and the cost of necessary protective measures are sufficient. Our firm evaluates these data breach cases on a contingency fee basis, meaning there are never any out-of-pocket costs or fees unless we successfully recover compensation on your behalf.