Upbound Group, the parent company of Rent-A-Center and the Acima lease-to-own business, began mailing data breach notification letters on September 23, 2026. The letters cover files that an unauthorized third party took from the company's cloud applications in early July. Upbound has confirmed the theft in a sample notice filed with California regulators.
The sample letter, dated September 23, appears on the California Attorney General's breach portal with a reported date of September 27. "On July 13, 2026, Upbound Group, Inc. learned of a cybersecurity incident in which an unauthorized third party gained access to certain computer files stored in cloud applications," the letter says. It adds that "between July 3 and July 6, 2026, an unauthorized third party obtained files that included certain individuals' personal information."
The sample letter does not say which kinds of data were taken. Its data-element line is an unfilled template placeholder, a gap PKWARE also noted. According to OpenClassActions, each recipient's letter lists the information involved for that person, so the individual notice is the place to check.
The July 8-K
On July 21, 2026, eight days after Upbound says it learned of the intrusion, the company filed a Form 8-K with the Securities and Exchange Commission. The filing said Upbound had "recently experienced cybersecurity incidents in which certain non-sensitive customer information and other documents were obtained without authorization." It did not give dates for those incidents.
The 8-K also linked the incidents to fraud. Upbound said it believes the stolen information was later used to help carry out fraudulent lease-to-own agreements. That activity contributed to "elevated fraudulent contract losses of approximately $13 million in the Company's Acima segment" in the second quarter of 2026. Even so, the company said that, based on what it knew then, it "believes that the incidents are not material." The disclosure was made under Item 8.01, "Other Events," and Upbound said it would reassess materiality under Item 1.05 if the facts changed. It also said it had notified federal law enforcement and added "enhanced authentication controls, additional fraud detection and monitoring capabilities."
PKWARE's 2026 breach roundup argues that the credit monitoring offer in the September letters, which refer to "certain individuals' personal information," conflicts with the earlier "non-sensitive" description, and notes that Upbound has not explained how the two disclosures relate. PKWARE also points out that the second-quarter fraud losses predate the July 3–6 window. In its reading, either the July event does not explain those losses or the 8-K covered other incidents Upbound has not described. No intrusion vector, affected application, or threat group has been publicly identified, according to PKWARE.
Who is affected
Upbound has not disclosed a total count of affected people in the California filing, the sample letter, or the 8-K. OpenClassActions also reports that no count has been given. PKWARE says a figure circulating on claims-aggregator sites, attributed to an Oregon filing, could not be corroborated, and it does not use that number.
According to PKWARE, the September 23 letters were filed with several state attorneys general, including those in California and Massachusetts. OpenClassActions reports that, according to the second lawsuit, Upbound notified Massachusetts regulators around September 29.
The letter offers recipients one year of Experian IdentityWorks credit monitoring, activated with a unique code that must be used by December 31, 2026. That deadline has not passed; it is 73 days away as of October 19. PKWARE reports that the offer also includes identity restoration and $1 million in identity theft insurance.
What the lawsuits claim
Two proposed class actions have been filed in the U.S. District Court for the Eastern District of Texas, according to OpenClassActions:
- Dunnam v. Upbound Group, No. 4:26-cv-01413, filed September 30, 2026. The complaint also names Acima Digital LLC.
- Dec v. Upbound Group, No. 4:26-cv-01457, filed October 8, 2026, against Upbound doing business as Get It Now.
Both cases are assigned to U.S. District Judge Michael J. Truncale. The first complaint alleges that names and Social Security numbers were exposed. That is a plaintiff's allegation; Upbound's public filings do not confirm which data elements were taken for any particular person. The Dunnam complaint brings claims including negligence, negligence per se, breach of implied contract, invasion of privacy, unjust enrichment, and breach of fiduciary duty. It alleges that notice came more than 90 days after the breach began and that the credit monitoring offer is inadequate. None of the allegations has been proven, Upbound has not yet responded in court, and no class has been certified.
What It Means for Defenders
- If you received a letter: check the data elements it lists for you and use the activation code before the deadline given above.
- Look for leases you did not open: check your credit reports and any Rent-A-Center or Acima account activity for agreements you don't recognize. A credit freeze with the major bureaus makes new-account fraud harder.
- Treat follow-up contact with suspicion: expect phishing that mentions the breach or the lawsuits. Contact Upbound, Acima, or Experian only through the numbers and addresses in the original letter or on the companies' own sites.
- For fraud and security teams at lenders and lease providers: review whether your application flows accept stolen identity data alone as proof of identity, and audit which customer files are kept in cloud applications and who can export them.
