Upbound Group Says Data Breach Led to $13 Million in Fraudulent Contract Losses
Upbound Group, a consumer finance company operating brands like Rent-A-Center, suffered a data breach resulting in approximately $13 million in fraudulent lease-to-own agreements. The company is investigating the incident, working with law enforcement and cybersecurity experts, but the scope and perpetrators remain unclear.
Upbound Group, Inc., a Texas-based consumer finance company providing lease-to-own and flexible payment solutions through brands such as Rent-A-Center, Acima, and Brigit, has reported a data breach that has led to significant financial losses. The company disclosed in a filing with the SEC that a recent cyberattack resulted in the theft of non-sensitive customer information and other documents. As a direct consequence, Upbound Group experienced elevated fraudulent lease-to-own agreements, incurring approximately $13 million in losses during the second quarter of 2026, primarily within its Acima segment. The company is currently investigating the incident, collaborating with law enforcement agencies, and engaging external cybersecurity specialists to enhance its security protocols. While the investigation is ongoing, Upbound Group believes that the incidents are not material at this time. The attackers’ identity remains unknown, and no known cybercrime group has publicly claimed responsibility for the attacks.