The data leak at Figure compromised 967,200 email accounts without relying on any software flaws. Understanding the implications of this, and why typical MFA solutions can’t prevent the resulting attacks, is a fundamental design issue, not a matter of user awareness training.

In February 2026, TechRepublic reported that Figure, a finance company, had a data breach that exposed nearly 967,200 email addresses. There was no exploitation of a security hole. No new flaws were used. The records were simply accessible, and now malicious actors have them.

Reporting on these incidents often just focuses on the number of records exposed. That’s a mistake. The record count isn’t the main event; it’s just the initial inventory for what happens next.

To really grasp the risk, you need to trace the potential attack path enabled by a data exposure like this, step by step, and evaluate if your authentication methods can effectively stop it at any stage.

In most cases, they can’t. Here’s why.

Compromised email addresses are not just static pieces of information. They are active items. Almost immediately after this data becomes available, cybercriminals begin using it in several attack methods simultaneously.

One technique is credential stuffing. Figure’s customers and staff probably used the same passwords on multiple sites. Attackers combine the revealed email addresses with previously exposed databases like LinkedIn, Dropbox, and RockYou2024, then try these combinations on corporate logins, VPNs, Microsoft 365, Okta, and other login systems. Automation handles the large scale.

Credential stuffing is often successful with fresh lists of email addresses, with success rates of two to three percent. On 967,000 accounts, that translates to about 19,000 to 29,000 valid username/password pairs.

Another method is targeted phishing. Using AI, custom-made phishing attacks can be created from an email list within minutes. These emails mention the organization by name, mimic internal company communications, and look almost identical to legitimate emails.

Targeting specific recipients by using job titles, departments, or LinkedIn data to customize the bait is standard practice, not just something nation-state attackers do.

A third method is social engineering through help desks. Armed with a valid email address and some background information, attackers impersonate employees when calling IT support, asking for password resets, MFA resets, or unlocking accounts.

This type of attack completely avoids authentication technology. Instead, it attacks the human procedures designed to handle authentication issues.

In each of these scenarios, no specific technical issue is used. Criminals don’t need to hack in; they want to log in as a valid user. The data leak doesn’t provide access; it sets the stage allowing existing authentication methods to be misused.

This is often downplayed in post-breach analyses. Companies read about a data leak and assume their MFA deployment is enough to protect them. But that assumption is fundamentally wrong for the attack methods described above.

Modern hacking tools can perform real-time phishing interception, also known as adversary-in-the-middle (AiTM) attacks. The mechanics are very precise.

An attacker sets up a fake website that intercepts communications between the victim and the real service. When the victim enters their login details on this fake page, the proxy immediately forwards those details to the real website.

The real site responds with a multi-factor authentication (MFA) request. The fake site forwards that request to the victim. The victim then responds because the page appears legitimate and the MFA prompt is real. The fake site forwards the response, and the hacker gains an authenticated session.

Push notification MFA, SMS codes, and TOTP authenticator apps are all vulnerable to this kind of interception. They verify a code, but they don’t confirm the person completing the process is the authorized user. They can’t tell the difference between a direct session and a proxied one.

Readily available hacking tools like Evilginx, Modlishka, Muraena, and their variants automate this kind of attack. Using these tools doesn’t require advanced skills. It’s just a standard method.

MFA fatigue intensifies the problem. If attackers get valid login credentials but cannot intercept the session in real-time, they might flood a user with push notifications until the user approves one out of frustration or confusion. This attack has been successful even at well-defended organizations, sometimes attracting media attention.

The common factor in all these techniques is that traditional MFA relies on a human to make the correct judgment call under circumstances specifically designed to make them fail.

The typical cybersecurity solution to login problems is user training. Teach users to spot phishing attempts. Encourage them to verify unexpected MFA requests. Remind them to reject requests they didn’t initiate.

This isn’t incorrect, but it’s not sufficient. The root of the problem is in the architecture, not simply in the user’s motivation.

A relay attack doesn’t require users to see a fake page. The MFA request they receive is authentic, issued by the real service, delivered through their regular app. There are no visible signs of anything unusual to detect. The attack is designed to be unnoticeable to the user — and it succeeds.

The real issue is that the authentication systems most organizations use weren’t created to address the main concern after a data breach: can you confirm that the authorized user was physically present and verified biometrically at the time of login?

Push notifications can’t answer that question. SMS codes can’t answer that question. TOTP can’t answer that question. USB hardware tokens answer a related but different question; they prove that the registered device was present, not that the authorized person was there.

Auditors, regulators, and cyber insurance providers are increasingly making this distinction. In CMMC assessments, NYDFS reviews, and insurance questionnaires, the question “can you prove the authorized user was physically present?” is appearing. Device presence is no longer sufficient as a substitute for human presence in situations where security is critical.

FIDO2/WebAuthn is frequently mentioned in this context, and it marks a significant improvement — but it is not enough on its own. Common passkey implementations link the credential to a specific device or a cloud account.

Cloud-synced passkeys are subject to the security problems of the cloud account: SIM swap attacks targeting the recovery phone number, account takeovers via phishing, and exploits in the recovery processes. Device-bound passkeys confirm device ownership, but not human presence.

Phishing-resistant authentication that stops relay attacks requires three properties at the same time:

• Cryptographic origin binding: The login credential must be mathematically connected to the specific website domain. A fake site can’t generate a valid signature because the domain won’t match. The attack fails before login information is sent.
• Hardware-bound private keys that never leave secure hardware: The signing key cannot be copied or stolen in any way. Even if a user’s computer is compromised, their credentials will remain safe.
• Live biometric verification: It needs to be a real-time biometric check making sure the person present matches the authorized person, not just using a stored biometric.

When these three things are simultaneously in place, a relay attack isn’t possible. The hacker can’t create a valid digital signature from a fake website. Since the cryptographic link will break the moment the origin changes, they can’t relay a session.

They can’t use a stolen device because it will fail the biometric check without authorized user. They also can’t socially-engineer their way in because there’s no login verification to approve; the authentication either succeeds with a verified live biometric at the registered hardware, or it fails.

TokenCore was based upon verifying the human, not just the device, credential, or session.

Many systems only add more security factors to a flawed foundation. Token replaces that core. The platform requires biometrics, hardware-based cryptographic logins, and verification of physical presence to be satisfied for access to be granted.

There are no alternative methods. There is no backup code that can be used if it fails. The authorized person is present and verified, or access is denied.

This is important because of the attack types being discussed. Token’s Biometric Assured Identity platform eliminates each component needed for the above methods:

• No Phishing: Every login is cryptographically linked to the domain involved. A fake login page cannot produce a valid signature; Token refuses to log in.
• No Replay: The private signing key remains secured within the hardware. A relayed session cannot be replicated, as the necessary cryptographic data is impossible to access.
• No Delegation: Each login requires a real-time fingerprint match. Neither a colleague, attacker with a stolen device, nor social engineering can authenticate as the actual authorized individual.
• No Exceptions: A biometric confirmation is the only method, with no substitute such as a recovery flow, a special code, or help-desk intervention. The firm control is justified by the magnitude of risk.

The device’s design is critical. Token is wireless, utilizing Bluetooth rather than requiring a USB port. Authentication takes only one to three seconds: the user starts a session and touches their fingerprint on their Token device, while Bluetooth confirms their physical proximity, and access is granted.

This eases the burden that encourages on-call administrators, trading floor operators, and defense contractors working across several workstations to use workarounds that create issues with shadow IT and security.

Token is upgraded remotely. As threats change, Token’s cryptographic safeguards can be updated with no need to replace or reissue hardware. This ensures the investment lasts, despite an evolving digital world.

The Figure data leak will lead to attacks on authentication methods. The next leak, and those following it, will as well. The malicious software infrastructure used to attempt credential stuffing, AI-created phishing, and real-time intercept attacks is constantly targeting exposed email records.

The question is not if these attacks will be attempted against your organization. They’re guaranteed to be.

Instead, ask yourself if your login system depends on humans making difficult judgments, or if it’s designed to prevent human error from being a weakness.

Traditional MFA relies on human awareness. A user must detect something unusual, doubt the request, and make the best decision when under pressure. This dependence is the weak link, and attackers now use toolkits to exploit it.

Token removes that weak link. Only a device signing for the verified domain with a confirmed biometric match will log in. No prompt to be manipulated, no decision to be misguided, and no exceptions.

That’s not just a perk, it’s the basic foundation for a login that remains secure after every incident, like the one described here.

Token’s Biometric Assured Identity platform is designed for organizations like defense contractors, financial institutions, critical infrastructure, and enterprises where a broken login is simply an unacceptable outcome.

Cryptographic. Biometric. Wireless. Fights phishing, replay attacks, delegation, and provides no exceptions.

To find out more, go to tokencore.com.

Sponsored and written by Token.