Upbound Group (Acima): stolen customer data used to file $13 million of fraudulent leases

What happened

• Upbound’s SEC filing says it “experienced cybersecurity incidents in which certain non-sensitive customer information and other documents were obtained without authorization”; a threat actor used that data to submit fraudulent lease-to-own agreements through Acima, causing about $13 million of losses in Q2 2026.
• Root cause: not disclosed.
• No group has claimed it.
• Enhanced authentication, fraud detection and monitoring added; law enforcement notified.

Sources

• https://www.bleepingcomputer.com/news/security/upbound-says-hack-caused-13-million-in-fraudulent-acima-leases/
• https://www.cm-alliance.com/cybersecurity-blog/major-cyber-attacks-data-breaches-ransomware-attacks-in-july-2026

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.