Upbound Group data breach: cloud files taken in July 2026, and $13.3 million of Acima lease fraud

What happened at Upbound?

Two filings describe it, two months apart. The customer letter says Upbound learned on July 13, 2026 that an unauthorized third party had got into computer files stored in cloud applications. The investigation, run with an outside cybersecurity firm, found files containing personal information had been taken between July 3 and 6. California's record gives July 3 and July 6, 2026 as the breach dates.

Nine days after that July 13 date, Upbound filed an 8-K under Item 8.01, "Other Events". It said the company had experienced cybersecurity incidents in which certain non-sensitive customer information and other documents were obtained without authorization. The 8-K speaks of incidents in the plural. Neither it nor the letter says whether the July 3 to 6 cloud files are one of them.

Date	What happened	Source
July 3 to 6, 2026	Files with personal information taken from cloud applications	Customer letter, California AG record
July 13, 2026	Upbound learns of the cloud incident	Customer letter
July 22, 2026	8-K, Item 8.01: incidents, about $13 million of Acima fraud losses in Q2, "not material"	Form 8-K
September 23, 2026	Letter date; notice sent, per Indiana	Customer letter, Indiana record
October 2, 2026	Published by Texas	Texas AG list
October 30, 2026	10-Q: $13.3 million of fraud losses for nine months	Form 10-Q

What did the 8-K say the stolen data was used for?

Fraudulent leases. Upbound said it believes information from some of the incidents was later used to make fraudulent lease-to-own agreements. That raised fraudulent contract losses in its Acima segment by about $13 million in the second quarter of 2026. Its fixes, with outside cybersecurity experts, were stronger authentication controls, more fraud detection and monitoring, and other security measures. It notified federal law enforcement.

On materiality, the 8-K said Upbound believed the incidents were not material, and that it would reassess under Item 1.05 if the facts changed substantively. That is why it filed under Item 8.01 and not Item 1.05. The guide to Item 8.01 versus Item 1.05 explains the difference and how incidents move between the two.

How much did the Upbound incidents cost?

The 10-Q for the quarter ended September 30, 2026 refers back to the July 22 8-K. It reports incremental estimated fraudulent contract losses of $13.3 million in the Acima segment for the nine months to that date. That is a loss from fraud that used the data, not a cost of responding to the breach. The 10-Q gives no response cost or insurance figure in that passage. The guide to what later 10-Q and 10-K filings say compares figures like this one, which measure different things, across thirteen other incidents.

What information was taken in the Upbound breach?

The 8-K called it non-sensitive. The September letters leave each person's list as a placeholder, "[Extra1]". The Texas record lists much more: name, address, Social Security number, driver's licence number, government ID such as a passport or state ID card, financial information, date of birth and "other". The filings do not reconcile the two descriptions. The 8-K was written nine days after Upbound learned of the cloud incident, and the letters followed once, they say, the investigation had concluded. Each letter as mailed lists that person's own items.

How many people were affected?

Indiana gives the only total: 76,327 people. Two states count their own residents:

Record	People counted
Indiana attorney general, total	76,327
Texas residents	6,280
Indiana residents	1,340

Texas published its report on October 2, 2026. It lists notice by U.S. mail, on a website, and by publication in print media. The ranking of breaches affecting Texans compares the count with other 2026 notices.

Washington's attorney general lists a notice from Upbound Group, Inc. reported on September 26, 2026, with 680 Washingtonians affected. Its record names names, Social Security numbers, driver's license or state ID numbers, full dates of birth and other information as the information compromised. The Washington ranking compares 2026's notices. The figure counts Washington residents only.

Was my information in the Upbound data breach?

A letter from Upbound Group dated September 23, 2026, from a return-mail address in Claysburg, Pennsylvania, means your information was in the taken files. Upbound offers one year of Experian IdentityWorks credit monitoring at no cost. The deadline to activate it is December 31, 2026, at experianidworks.com/1Bcredit with the code in the letter. Its line for questions is 833-918-1248, 9:00 a.m. to 9:00 p.m. Eastern Time, Monday to Friday.

Because the 8-K says stolen information was used to open fraudulent leases, the thing to watch for is a lease-to-own agreement you did not sign, along with new credit. The letter advises watching account statements and credit reports for the next 12 to 24 months. The guide to credit-monitoring offers compares Upbound's one-year offer with others in this log.

What the filings leave open

• Whether the July 3 to 6 cloud incident is one of the incidents in the 8-K, and how many incidents there were.
• Which cloud applications held the files.
• Why the 8-K said "non-sensitive" while Texas lists Social Security and driver's licence numbers.
• How many fraudulent leases were opened, and whether the people named on them are among the 76,327.