Almeida Law Group is investigating a data breach at Upbound Group, Inc. If you were affected, contact Almeida Law Group.
About Upbound Group, Inc.
Upbound Group, Inc. (NASDAQ: UPBD), formerly known as Rent-A-Center, Inc., is a technology and data-driven consumer finance company that provides lease-to-own and flexible payment solutions. Headquartered in Plano, Texas, the company operates through four segments: Acima (virtual lease-to-own through third-party retailers), Rent-A-Center (brick-and-mortar stores), Brigit (financial health tools), and Mexico. It operates over 2,300 company-branded retail units across the United States, Mexico, and Puerto Rico, and rebranded from Rent-A-Center to Upbound Group in February 2023. Because the company collects customer information in connection with lease-to-own financing agreements, a breach exposing Social Security Numbers carries meaningful risk of identity theft and financial fraud for affected consumers.
What Happened?
Upbound Group, Inc. was listed in a Vermont Attorney General breach report summary published September 26th, 2026, identifying Social Security Numbers as the category of data reported breached. The organization type is listed as Other Commercial. The total number of affected individuals has not been publicly disclosed.
The Vermont AG filing followed an earlier disclosure: on July 21st, 2026, Upbound Group filed an SEC Form 8-K reporting a material cybersecurity incident in which hackers obtained customer information and other documents. That stolen data was then used to facilitate fraudulent lease-to-own agreements through the company’s Acima segment, contributing to approximately $13 million in fraudulent contract losses during the second quarter of 2026. At the time of the SEC filing, the company described the compromised data only as “non-sensitive customer information and other documents” — notably, without specifically identifying Social Security Numbers. The September 26th, 2026 Vermont AG filing lists Social Security Numbers as a breached data category, suggesting that either the ongoing investigation revealed more sensitive data was compromised than initially understood, or the Vermont notification reflects updated or separate findings. Upbound notified law enforcement and engaged external cybersecurity experts. No ransomware group or named threat actor has publicly claimed responsibility for the attack, according to multiple cybersecurity news sources.
Key Facts at a Glance
- Company or Organization: Upbound Group, Inc.
- Industry: Consumer finance / lease-to-own retail
- Location: Plano, Texas
- Incident type: Cybersecurity breach; customer data obtained and used to facilitate fraudulent lease agreements
- Date of consumer notification: September 26th, 2026
- Prior breach: None identified
- Litigation status: No class action lawsuits specifically connected to this breach were found as of late September 2026
- Source: Vermont Attorney General breach report summary; SecurityWeek; BleepingComputer
What Should You Do?
If you received notice that your information was involved in this breach, consider placing a fraud alert or credit freeze with each of the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent unauthorized accounts from being opened in your name. You can request your free annual credit reports at AnnualCreditReport.com and review them carefully for unfamiliar accounts or activity. Because Social Security Numbers were involved, monitor your financial accounts closely for any suspicious transactions. If you detect signs of fraud or identity theft, report them to the Federal Trade Commission at IdentityTheft.gov, which can help you create a personalized recovery plan.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
