Upbound Group and Acima Leasing: Upbound says hack caused $13 million in fraudulent Acima leases

Upbound Group Reports $13 Million Fraud Loss Following Cyberattack on Acima Leasing

Upbound Group, a fintech company specializing in lease-to-own (LTO) financial solutions, disclosed a cybersecurity incident in an SEC filing that led to $13 million in fraudulent Acima leases. The breach, detected earlier this year, involved unauthorized access to non-sensitive customer data and internal documents, which threat actors exploited to secure fraudulent lease agreements.

The attackers used the stolen information to obtain goods through Acima’s lease-to-own system, bypassing payment obligations. While Acima reimbursed participating retailers for the merchandise, the fraudsters absconded with the goods without making lease payments, resulting in a $13 million loss for the company in Q2 2024.

Upbound, formerly known as Rent-A-Center, operates multiple brands, including Acima Leasing, Rent-A-Center, Brigit, and Upbound Mexico. Acima provides LTO payment options via third-party retailers and e-commerce platforms.

Upon discovering the breach, Upbound implemented remediation measures with external cybersecurity experts, including enhanced authentication controls, fraud-detection systems, and improved monitoring. Federal law enforcement was also notified. The company continues to investigate the incident but has stated that the attack’s impact was not material enough to influence investment decisions.

No ransomware or data extortion groups have claimed responsibility for the breach, and details on the number of affected customers remain undisclosed. Upbound has not responded to media inquiries for further information.

Source: https://www.bleepingcomputer.com/news/security/upbound-says-hack-caused-13-million-in-fraudulent-acima-leases/

Upbound Group cybersecurity rating report: https://www.rankiteo.com/company/upboundgroup

"id": "UPB1784759016",
"linkid": "upboundgroup",
"type": "Breach",
"date": "4/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Lease-to-own (LTO) financial solutions',
                        'name': 'Upbound Group (Acima Leasing)',
                        'type': 'Fintech Company'}],
 'attack_vector': 'Unauthorized access to non-sensitive customer data and '
                  'internal documents',
 'data_breach': {'sensitivity_of_data': 'Non-sensitive',
                 'type_of_data_compromised': 'Non-sensitive customer data and '
                                             'internal documents'},
 'description': 'Upbound Group disclosed a cybersecurity incident in an SEC '
                'filing that led to $13 million in fraudulent Acima leases. '
                'The breach involved unauthorized access to non-sensitive '
                'customer data and internal documents, which threat actors '
                'exploited to secure fraudulent lease agreements. The '
                'attackers used the stolen information to obtain goods through '
                'Acima’s lease-to-own system, bypassing payment obligations.',
 'impact': {'data_compromised': 'Non-sensitive customer data and internal '
                                'documents',
            'financial_loss': '$13 million'},
 'investigation_status': 'Ongoing',
 'motivation': 'Financial gain',
 'references': [{'source': 'SEC filing'}],
 'regulatory_compliance': {'regulatory_notifications': 'SEC filing'},
 'response': {'enhanced_monitoring': 'Yes',
              'law_enforcement_notified': 'Federal law enforcement',
              'remediation_measures': 'Enhanced authentication controls, '
                                      'fraud-detection systems, and improved '
                                      'monitoring',
              'third_party_assistance': 'External cybersecurity experts'},
 'title': 'Upbound Group Reports $13 Million Fraud Loss Following Cyberattack '
          'on Acima Leasing',
 'type': 'Fraudulent Lease Agreements'}