Did Upbound Group, Inc. have a data breach?

In plain terms

Upbound Group, Inc. reported a data breach on September 28, 2026, stemming from an incident on July 3, 2026. The breach involved highly sensitive personal and financial information, raising concerns for affected individuals about potential identity theft and fraud.

Upbound Group, Inc. filed a data breach notification with Oregon authorities on September 28, 2026, disclosing an incident that occurred on July 3, 2026. The company, a prominent leader in lease-to-own and financial services, confirmed that customer data was compromised.

The breach type was unspecified, but it involved unauthorized access to sensitive personal information. Given Upbound Group's business model, which handles extensive consumer financial data, such incidents often involve vulnerabilities within network infrastructure or third-party vendor systems.

The exposed information includes Full Name, Social Security Number, Date of Birth, Financial Account Number, Routing Number, Mailing Address, Driver's License Number, and Transaction History. This combination of identifiers and financial details presents significant risks for those affected.

Individuals whose data was exposed face an elevated threat of identity theft, fraudulent credit applications opened in their name, and unauthorized withdrawals from their bank accounts. Cybercriminals can use this information to cause substantial financial harm.

To safeguard against potential misuse of their data, affected individuals should actively monitor their financial accounts and credit reports for any suspicious activity. Placing a fraud alert or freezing credit with the major credit bureaus are also widely recommended steps. Reviewing all account statements regularly can help detect unauthorized transactions promptly.