Figure Technology Solutions Data Breach Affects 26,128 Washingtonians

February 23, 2026 Via Portal Washington State Office of Attorney General Nick Brown Re: Figure Technology Solutions, Inc. - Notice of Security Incident To whom it may concern:

On behalf of Figure Technology Solutions, Inc. and its affiliates ("Figure"), I am writing to provide notice of a security incident (the "Incident") involving Figure.

On or around January 28, 2026, the Company discovered that an employee had been socially engineered to provide an unauthorized actor access to their account. The Company immediately activated its incident response process and took steps to stop the activity. Guidepoint Security LLC, a leading cybersecurity firm, Orrick, Herrington & Sutcliffe LLP as incident response counsel, and other outside advisors were promptly engaged to investigate what happened and determine what data was affected. The Company also notified law enforcement. Figure has not observed any unauthorized activity since January 28, 2026. As a result of the investigation, Figure recently determined that some customer information

was acquired by the unauthorized actor. The specific information is identified in individuals'

notifications and can include name, address, Social Security number, date of birth, loan account number, and loan information. Figure is notifying 26,128 state residents beginning February 24, 2026 and will offer them two years of complimentary credit monitoring and identity restoration services with TransUnion. A copy of the consumer notice is enclosed.

The Incident has not affected the Company's customer-facing operations, including loan

origination, loan servicing, and customer service operations, and the Company continues to serve its customers. Customer accounts are not affected, and no customer funds or virtual wallets have been impacted. Additionally, the Company continuously monitors accounts with strong safeguards in place to protect customer funds. Protecting the privacy of personal information is a top priority for the Company. Figure is committed to maintaining the privacy of personal information in its possession and has taken many precautions to safeguard it and continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information.

Orrick, Herrington & Sutcliffe LLP James Chou 2100 Pennsylvania Avenue NW Washington, D.C. 20037 E james.chou@orrick.com +1 202 339 8400 D +1 202 349 8003 orrick.com

Should you have any questions concerning this notification, please contact me at 202-349- 8003 or james.chou@orrick.com. Sincerely,

/s/ James Chou

James Chou Sr. Associate| Orrick, Herrington & Sutliffe LLP

Figure Lending Corp c/o Cyberscout

P.O. Box 3826 Suwanee, GA 30024

U.S. INDIVIDUAL NOTICE February 24, 2026 Re: Notice of Data Breach

Figure Lending Corp and its subsidiaries, Figure Lending LLC, Figure Markets Credit LLC and Figure Payments Corporation (collectively, "We" or "Figure") are writing to let you know about a security incident that affected your personal information. Figure is a technology-driven lender specializing in blockchain enabled home equity lines of credit and refinancing, and crypto-backed loans. We also provide technology and loan administrative services to other lenders and business partners, which may have included the origination and/or servicing of a loan you have with our business partner lenders. Please read this notice carefully, as it provides up-to-date information on what happened and what we are doing, as well as information on how you can obtain complimentary credit monitoring and identity restoration services. What happened? Recently, Figure discovered unauthorized activity on our systems. We acted quickly to stop the activity and enhance our security measures, and we began working with a leading cybersecurity firm to investigate what happened. We also reported the incident to law enforcement and offered our full cooperation. However, we did identify evidence that on January 28, 2026 data containing personal information was obtained through queries on company databases that store loan and loan inquiry data. There was no evidence of unauthorized access to customer accounts and funds, and our business operations continue uninterrupted. Additionally, we continuously monitor accounts, which have strong safeguards in place to protect your funds. What information was involved? We have determined that your name, address, phone number, email, loan number, and date of birth were or may have been obtained. Your Social Security Number was not affected. What we are doing: We are committed to safeguarding confidential and sensitive information. We are offering two years of complimentary credit monitoring and identity restoration services through our third-party vendor, TransUnion. Please see Attachment A for details regarding these complimentary credit monitoring and identity restoration services, as well as how to enroll with your unique code. You must enroll by May 31, 2026, to receive these services. In addition to these actions, we have implemented enhanced security and monitoring controls. We remain committed to ongoing information security reviews to strengthen our security and privacy programs and controls.

Wha t you can do: In addition to enrolling in the credit monitoring and identity restoration services being offered to you at no charge, we encourage you to take the following precautions:

• It is always a good idea to remain vigilant against threats of identity theft or fraud and to regularly review and
  monitor your account statements and credit history for any signs of unauthorized transactions or activity.

• If you ever suspect that you are the victim of identity theft or fraud, you can contact your local police. Additi onal
  informatio n about how to protect your identity is contained in Attach ment B. ore information: For m Figure has established a dedicated call center to answer questions about the security incident as well as the credit monitoring and identity restoration services that we are offering to you. If you have any questions, please call the call center at 1-855-522-6935, from 8 a.m. to 8 p.m. ET Monday through Friday, excluding major U.S. holidays. Sincerely, The Figure Team

Attachment A - ADDITIONAL DETAILS REGARDING YOUR 24-MONTH CREDIT MONITORING To acti vate your membership and start monitoring your personal information please follow the steps below:

• Ensure that you enroll by May 31, 2026 (Your code will not work after this date.)
• Visit the TransUnion website to enroll.
• For Adults: https://bfs.cyberscout.com/activateProvide your activation code: Attachment B - MORE INFORMATION ABOUT IDENTITY PROTECTION ON OBTAINING A FREE CREDIT REPORT INFORMATION U.S. customers are entitled under U.S. law to one free credit report annually from each of the three major credit bureaus. To order your free credit reports, visit www.annualcreditreport.com or call toll-free +1 (877) 322-8228. INFORMATION ON IMPLEMENTING A FRAUD ALERT OR A SECURITY FREEZE You can contact the three major credit bureaus at the addresses below to place a fraud alert on your credit report. A fraud alert indicates to anyone requesting your credit file that you suspect you are a possible victim of fraud. A fraud alert does not affect your ability to get a loan or credit. Instead, it alerts a business that your personal information might have been compromised and requires that business to verify your identity before issuing you credit. Although this may cause some short delay if you are the one applying for the credit, it might protect against someone else obtaining credit in your name. A security freeze prohibits a credit reporting agency from releasing any information from a consumer's credit report without written authorization. However, please be aware that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit, mortgages, employment, housing, or other services. A credit reporting agency may not charge you to place, temporarily lift, or permanently remove a security freeze. To place a fraud alert or a security freeze on your credit report, you must contact the three credit bureaus below: Equifax Experian TransUnion Consumer Fraud Division Credit Fraud Center TransUnion LLC P.O. Box 740256 P.O. Box 9554 P.O. Box 2000 tlanta, GA 30374 llen, TX 75013 Chester, PA 19022-2000 888 766-0008 888 397-3742 800 680-7289 www.equifax.com www.experian.com www.transunion.com To request a security freeze, you will need to provide the following information:

1. Your full name (including middle initial as well as Jr., Sr., II, III, etc.);
2. Social security number;
3. Date of birth;

4. If you have moved in the past five (5) years, the addresses where you have lived over those prior five (5)
   years;

5. Proof of current address such as a current utility bill or a telephone bill; and

6. A legible photocopy of a government-issued identification card (state driver's license or ID card, military
   identification, etc.). You may also contact the U.S. Federal Trade Commission (FTC) for further information on fraud alerts, security freezes, and how to protect yourself from identity theft. The FTC can be contacted at 400 7th St. SW, Washington, DC 20024; telephone +1 (877) 382-4357 or www.consumer.gov/idtheft.

RESOURCES ADDITIONAL

Your state Attorney General may also have advice on preventing identity theft, and you should report instances of known or suspected identity theft to law enforcement, your state Attorney General, or the FTC. California residents: Visit the California Office of Privacy Protection (https://oag.ca.gov/privacy) for additional information on protection against identity theft. District of Columbia residents: The District of Columbia Attorney General may be contacted at: 400 6th Street, NW, Washington, DC 20001; +1 (202) 727-3400, oag@dc.gov and www.oag.dc.gov. Iowa residents: The Attorney General can be contacted at Office of Attorney General of Iowa, Hoover State Office Building, 1305 E. Walnut Street, Des Moines, Iowa 50319; +1 (515) 281-5164, www.iowaattorneygeneral.gov.

AA((( ) ) )

Kentucky residents: The Attorney General can be contacted at Office of the Attorney General of Kentucky, 700 Capitol Avenue, Suite 118 Frankfort, Kentucky 40601, www.ag.ky.gov, Telephone: +1 (502) 696-5300. Maryland residents: The Attorney General can be contacted at Office of Attorney General, 200 St. Paul Place, Baltimore, Maryland 21202; +1 (888) 743-0023 or www.marylandattorneygeneral.gov. Massachusetts residents: Under Massachusetts law, you have the right to obtain any police report filed in connection with the cybersecurity event. If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it. North Carolina residents: The Attorney General can be contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001; +1 (919) 716-6400 or www.ncdoj.gov. New Mexico residents: You have rights under the federal Fair Credit Reporting Act (FCRA), which governs the collection and use of information pertaining to you by consumer reporting agencies. For more information about your rights under the FCRA, please visit www.consumer.ftc.gov/articles/pdf-0096-fair-credit-reporting-act.pdf or www.ftc.gov. New York residents: The Attorney General can be contacted at the Office of the Attorney General, The Capitol, Albany, NY 12224-0341; +1 (800)-771-7755 or www.ag.ny.gov. Oregon residents: The Attorney General can be contacted at Oregon Department of Justice, 1162 Court Street NE, Salem, OR 97301-4096; +1 (877) 877-9392 (toll-free in Oregon), +1 (503) 378-4400, or www.doj.state.or.us. Rhode Island residents: The Attorney General can be contacted at 150 South Main Street, Providence, Rhode Island 02903; +1 (401) 274-4400 or www.riag.ri.gov. You may also file a police report by contacting local or state law enforcement agencies. For Arizona, California, Iowa, Montana, Washington and West Virginia residents: You may obtain one or more (depending on the state) additional copies of your credit report, free of charge. You must contact each of the credit bureaus directly to obtain such additional report(s).