Hackers Steal Data, Cause $13 Million in Fraudulent Leases for Upbound Group
Stolen customer records let criminals set up fake lease-to-own agreements through Acima, costing Upbound Group roughly $13 million in Q2 2023.
Key points
- Hackers stole customer data from Upbound Group and used it to generate $13 million in fraudulent Acima lease agreements.
- Upbound disclosed the breach in a U.S. Securities and Exchange Commission (SEC) filing.
- Fraudsters took the merchandise but never made the required lease payments, leaving Acima holding the loss.
- No ransomware group has claimed the attack; the precise entry method hasn't been made public.
Upbound Group, the fintech firm formerly known as Rent-A-Center, disclosed in an SEC filing that attackers stole non-sensitive customer information and used it to generate roughly $13 million in fraudulent lease agreements through its Acima brand during Q2 2023. Acima offers lease-to-own payment options through third-party retailers and e-commerce platforms. The criminals used the stolen records to obtain goods under fake agreements, Acima paid the participating retailers, and the fraudsters kept the merchandise without making a single lease payment.
The breach sits alongside a broader wave of financially motivated intrusions we've been tracking: Threat Vectr has published 28 fraud-related stories since 30 June 2026, including our report on 23andMe's $18 million settlement after state attorneys general called its pre-breach security "flimsy". What ties these cases together is that the stolen data doesn't need to be sensitive in the traditional sense. Names, addresses and partial account details are enough to abuse a frictionless credit or lease system at scale.
Upbound says it detected the intrusion quickly and brought in external cybersecurity experts. It has since tightened authentication controls, added fraud-detection mechanisms and improved system monitoring. Federal law enforcement was also notified. The company's own assessment is that the attack wasn't significant enough to affect investment decisions, though the investigation is continuing.
How did the hackers get in?
Upbound hasn't said publicly how attackers gained access. No ransomware group or data extortion actor has claimed responsibility, which makes attribution harder. The SEC filing describes the stolen material as "certain non-sensitive customer information and other documents," which suggests credential stuffing or a third-party exposure rather than a sophisticated network intrusion, though that's a judgement call, not a confirmed finding.
Should you worry if you're an Acima customer?
Upbound hasn't confirmed how many customers were affected and didn't reply to requests for that figure before the original story published. If your data was involved, the practical risk here isn't a drained bank account; it's someone else taking out a lease in your name. Check your credit report for unfamiliar accounts, and flag anything odd to the retailer or lender involved rather than waiting for a statement. The fraud model here relies on speed: goods are taken quickly before the fake lease falls apart. Getting ahead of it early is the only real mitigation available to customers right now.
