The California Office of the Attorney General disclosed a data breach affecting Funding Circle in March 2018, stemming from an incident on June 1, 2017. Unauthorized third parties gained access to email accounts belonging to one of the company’s data vendors, exposing sensitive customer information. The compromised data included names, addresses, phone numbers, and Social Security numbers (SSNs)—highly sensitive personal identifiers that could facilitate identity theft or financial fraud. While the breach originated from a third-party vendor, the responsibility for safeguarding customer data ultimately fell on Funding Circle, given its role as the primary entity entrusted with protecting such information. The exposure of SSNs elevates the severity, as this data is a prime target for cybercriminals and can lead to long-term repercussions for affected individuals, including fraudulent loan applications, tax fraud, or unauthorized account openings. The incident underscores vulnerabilities in supply chain security, where third-party vendors with access to critical systems can become entry points for attackers. No ransomware was involved, but the scale and nature of the leaked data—particularly SSNs—significantly amplify the breach’s impact on customer trust and regulatory compliance.

London-based business loans provider, Funding Circle suffered from a data breach incident that exposed 6,000 social security numbers of American clients. The exposed information includes Security, credit scores, and business loan histories of clients. They investigated the incident and secured its systems and databases.

On April 27, 2017, Funding Circle USA, Inc. experienced a data breach due to a vulnerability in one of its databases. The exposed information included sensitive personal details such as names, addresses, contact information, and social security numbers of guarantors. While the vulnerability had the potential to compromise this data, investigations confirmed that no third-party access or theft of customer information occurred. The exact number of affected individuals remains undetermined. The incident was formally reported to the California Office of the Attorney General on May 30, 2017. The breach highlighted a critical gap in database security, though the lack of confirmed unauthorized access mitigated the immediate fallout. However, the exposure of personally identifiable information (PII) posed a latent risk of identity theft or fraud if exploited in the future.