New American Funding, LLC (Figure Lending, LLC had incident) data breach

What we know

New American Funding, LLC and its partner entity Figure Lending, LLC operate at the intersection of modern mortgage lending, digital financial services, and home equity financing. As prominent institutions in the consumer finance and mortgage sector, these companies handle vast quantities of highly sensitive consumer financial data, underwriting files, credit histories, and personal identification records on a daily basis. To facilitate seamless home loans, refinances, and HELOC products, they routinely collect and store foundational personal information required for credit evaluation, asset verification, and regulatory compliance, making their digital infrastructure a central repository for deeply private consumer documents.

In 2026, a security incident impacting Figure Lending, LLC was formally reported to the Washington Attorney General, highlighting escalating vulnerabilities within financial technology and digital lending platforms. Breaches affecting financial institutions typically involve sophisticated cyberattacks, unauthorized network intrusion, third-party vendor compromises, or exploitation of system vulnerabilities that expose internal databases housing customer files. Given the interconnected nature of modern mortgage origination—where third-party service providers, cloud storage environments, and automated underwriting systems constantly exchange data—an intrusion can quickly compromise sensitive repositories before security teams are able to contain the threat.

The exposure of financial and identity data in an incident of this nature carries severe, long-term risks for affected consumers. When records containing names, Social Security numbers, banking details, and credit profiles are accessed by unauthorized actors, victims face an immediate and elevated threat of identity theft, financial account takeover, and fraudulent loan applications. Unlike transient retail breaches where payment cards can simply be replaced, the compromise of core identity markers and historical financial records exposes individuals to prolonged risks of synthetic fraud, tax return tampering, and unauthorized credit inquiries that can damage financial standing for years.

Financial institutions like New American Funding and Figure Lending are bound by rigorous federal and state regulatory frameworks, most notably the Gramm-Leach-Bliley Act (GLBA) and the Washington My Health My Data Act or state consumer protection statutes, which mandate strict administrative, technical, and physical safeguards to protect non-public personal information. Under these legal standards, institutions have an affirmative duty to maintain robust encryption, conduct continuous network monitoring, and vet third-party vendor security practices. The occurrence of a significant data breach strongly suggests potential failures in fulfilling these statutory obligations, raising serious questions regarding whether adequate cybersecurity measures were implemented to thwart unauthorized access.

Receiving an official data breach notification letter from the company serves as formal legal acknowledgment that your private information was compromised due to inadequate security infrastructure. Under established legal principles, this notification establishes the necessary legal standing to participate in a class action lawsuit aimed at holding the responsible parties accountable. Affected individuals do not need to prove that they have already suffered actual financial loss or identity theft to seek legal redress; the increased risk of future harm and the cost of necessary protective measures are sufficient. Our firm evaluates these data breach cases on a contingency fee basis, meaning there are never any out-of-pocket costs or fees unless we successfully recover compensation on your behalf.

See every breach reported in Washington or read what to do after a ransomware attack.