Upbound Group Data Breach Impacts 76k: Investigation Ongoing

Upbound Group Inc., a financial services company that operates lease-to-own brands including Rent-A-Center and Acima Leasing, disclosed a cybersecurity incident in which unauthorized actors accessed customer information.

Unauthorized actors gained access to certain non-sensitive customer information and related documents belonging to Upbound Group. The stolen data was then allegedly used to fraudulently create lease-to-own agreements through the company's Acima Leasing platform.

Details about the breach were also posted publicly on an open web network on July 23, 2026. The posting confirmed the incident as a data breach involving unauthorized access to customer data. No specific threat actor has been named in connection with the incident.

The specific types of personal data involved in the incident included names, addresses, Social Security numbers, driver’s license numbers, government-issued ID numbers such as passport or state ID card, and financial Information such as account number, credit or debit card number.

A total of 76,327 individuals were identified as impacted, including 6,280 residents of Texas, 1,340 of Indiana, 445 of Massachusetts and 101 of New Hampshire. The incident was disclosed to the attorneys general offices of California and Vermont, as well as to the U.S. Securities and Exchange Commission.

Upbound Group's response to the breach

Upbound Group implemented additional security controls across its systems. The company strengthened its fraud detection and monitoring capabilities in an effort to identify and prevent further misuse of the accessed information.