Incident · State breach notice (Massachusetts)
World Acceptance data breach: 232,401 people after an intrusion into the lender's network in August 2026
Compiled from public records. Updated 2026-11-08. By the cisonews.net Desk.
World Acceptance Corporation reported a data breach affecting 232,401 people in total, the figure on Indiana's attorney general list. Indiana counts 7,308 of them as its own residents and dates the breach to August 20, 2026. The company's letter says an unknown party gained unauthorized access to its network environment. On or about September 8, 2026, World Acceptance determined that personal information may have been involved. Notices went out on September 30, 2026, with 24 months of single-bureau credit monitoring from Epiq.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.
How many people were affected by the World Acceptance data breach?
232,401 in total, according to the number World Acceptance reported to Indiana. The letter gives no count.
| Regulator | Who it counts | Number | Recorded |
|---|---|---|---|
| Indiana attorney general | Total reported by World Acceptance | 232,401 | Notice September 30, 2026 |
| Texas attorney general | Texans | 51,073 | Posted October 2, 2026 |
| Indiana attorney general | Indiana residents | 7,308 | Notice September 30, 2026 |
| Massachusetts consumer affairs office | Massachusetts residents | 15 | Two reports, September 30, 2026 |
Texas's attorney general lists 51,073 Texans for World Acceptance, posted on October 2, 2026.
Massachusetts logged two reports from World Acceptance on the same day (2026-1681 and 2026-1682), each for 15 residents. Both mark Social Security numbers and driver's license numbers as breached. The record does not say whether the two reports cover the same people.
What happened at World Acceptance?
| Date | Event |
|---|---|
| August 20, 2026 | Breach date on Indiana's record |
| September 8, 2026 | World Acceptance determines that personal information may have been involved (on or about) |
| September 30, 2026 | Notices to individuals, Indiana and Massachusetts |
| October 23, 2026 | Quarterly results filed with the SEC on Form 8-K |
The letter says World Acceptance secured its environment once it learned of the access, investigated, and reviewed the affected information. It does not say when the company learned of the access, how the intruder got in, or what was taken.
What information was involved?
The filed copy names the reader's name and leaves the rest of the list as a blank to fill in. Massachusetts records Social Security numbers and driver's license numbers for its residents. Anyone who got a letter should read the list printed in it.
What is World Acceptance offering?
| Item | Detail from the letter |
|---|---|
| Service | Single-bureau credit monitoring, credit report and credit score from Epiq Privacy Solutions ID, with alerts for 24 months from enrollment |
| Extra | Proactive fraud assistance |
| Enrollment | Online, following the instructions on page 2 of the letter |
The filed copy leaves the response line's number blank, so use the number printed on your own letter. The guide to credit monitoring offers compares offers like this one.
Did World Acceptance tell investors?
Not in any filing so far. World Acceptance files reports with the SEC. Its only 8-K since the breach is its October 23, 2026 results filing under Items 2.02 and 7.01, and it does not mention the incident. There is no Item 1.05 or Item 8.01 8-K about it. The guide to Item 8.01 versus Item 1.05 explains the forms.
What the documents leave open
- When World Acceptance discovered the intrusion, and how the unknown party got in.
- Which data elements were involved overall.
- Whether the 232,401 are current borrowers, former borrowers or applicants.
Other financial services incidents on cisonews.net
- ICW Group Holdings, Inc., Breach notice, first disclosed November 13, 2026
- Point72 Asset Management, L.P., Breach notice, first disclosed November 5, 2026
- The Vanguard Group, Inc., Breach notice, first disclosed November 4, 2026
- Hippo Analytics, Breach notice, first disclosed November 3, 2026; 176,128 affected in total (Indiana Attorney General)
- Baanx US Corp, Breach notice, first disclosed October 30, 2026; 6,594 affected in total (Indiana Attorney General)
Sources
- 2026-09-30 · AWorld Acceptance Corporation, notice filed with the Massachusetts Office of Consumer Affairs and Business Regulation, published September 30, 2026
- 2026-11-08 · AIndiana Attorney General, data breach year-to-date report (2026), published November 8, 2026
- 2026-11-08 · AMassachusetts Office of Consumer Affairs and Business Regulation, 2026 Data Breach Notification Report, published November 8, 2026
- 2026-10-23 · AWorld Acceptance Corporation, Form 8-K, Items 2.02 and 7.01 (SEC EDGAR), published October 23, 2026
- 2026-11-08 · ATexas Attorney General, data security breach reports, published November 8, 2026
Tier A: the organization itself (including notices it filed with a state attorney general), a regulator or SEC EDGAR. Tier B: established press. Each fact on this page carries its supporting passage in the page source.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.