Upbound Group, Inc.

Upbound Group, Inc. based in Plano, Texas, a other entity reported a data breach to the Texas Attorney General. The breach was discovered on 2026-07-13 and reported on 2026-10-02. 6,280 Texas residents were affected. 76,327 individuals affected in total. Types of information involved: Name of individual;Address;Social Security Number Information;Driver’s License number;Government-issued ID number (e.g. passport, state ID card);Financial Information (e.g. account number, credit or debit card number);Other;Date of Birth. Consumers were notified via Notice by publication in print media;Posted at company website or special website;U.S. Mail.

Upbound Group, Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2026-09-28. The breach occurred during 7/3/2026 - 7/6/2026. The breach was discovered on 7/13/2026. 76,327 individuals were affected. Notice was sent on 9/23/2026.

Upbound Group, Inc. notified the California Attorney General of a cybersecurity incident where an unauthorized third party accessed cloud-stored files between July 3 and July 6, 2026. The company discovered the incident on July 13, 2026. Personal information was affected. The company engaged a cybersecurity expert, implemented containment measures, and offered one year of credit monitoring via Experian. Rhode Island residents were specifically noted as potentially impacted.

Upbound Group, Inc. reported a data breach to the Vermont Attorney General. The breach was reported to the AGO on 2026-09-26. The reporting organization type is Other Commercial. 42 Vermont residents were affected. Categories of data breached: Social Security Numbers.

Upbound Group, Inc. notified the New Hampshire Attorney General of a cybersecurity incident discovered on July 13, 2026. An unauthorized third party gained access to cloud applications via a social engineering attack targeting an employee between July 3-6, 2026. Approximately 101 New Hampshire residents were affected, with personal information including names, addresses, phone numbers, emails, dates of birth, and Social Security numbers. Upbound engaged forensic experts, notified law enforcement, and provided one year of complimentary credit monitoring through Experian to affected individuals.

Upbound Group Inc reported a data breach to the Indiana Attorney General. The breach occurred on 2026-07-03 and was reported on 2026-09-23. 1,340 Indiana residents were affected. 76,327 individuals affected in total.

Upbound Group, Inc. notified Massachusetts residents of a data security incident where an unauthorized third party obtained files containing personal information. The company engaged a cybersecurity expert for investigation and containment. Affected individuals are offered two years of complimentary credit monitoring via Experian. Specific data types and dates of discovery/occurrence are not detailed in the provided notice.

Upbound Group, Inc. disclosed cybersecurity incidents involving unauthorized access to non-sensitive customer information and documents. The company believes the data was used to facilitate fraudulent lease-to-own agreements, contributing to about $13 million in fraudulent contract losses in its Acima segment in Q2 2026. It implemented enhanced authentication and fraud detection and notified federal law enforcement. The investigation is ongoing; the company deems the incidents immaterial.