Skip to content
cisonews.net

Incident · State breach notice (Massachusetts)

World Acceptance data breach: 232,401 people after an intrusion into the lender's network in August 2026

Compiled from public records. Updated 2026-11-08. By the cisonews.net Desk.

World Acceptance Corporation reported a data breach affecting 232,401 people in total, the figure on Indiana's attorney general list. Indiana counts 7,308 of them as its own residents and dates the breach to August 20, 2026. The company's letter says an unknown party gained unauthorized access to its network environment. On or about September 8, 2026, World Acceptance determined that personal information may have been involved. Notices went out on September 30, 2026, with 24 months of single-bureau credit monitoring from Epiq.

Entries like this one, in Wednesday’s docket

Wednesdays

Unsubscribe any time.

How many people were affected by the World Acceptance data breach?

232,401 in total, according to the number World Acceptance reported to Indiana. The letter gives no count.

RegulatorWho it countsNumberRecorded
Indiana attorney generalTotal reported by World Acceptance232,401Notice September 30, 2026
Texas attorney generalTexans51,073Posted October 2, 2026
Indiana attorney generalIndiana residents7,308Notice September 30, 2026
Massachusetts consumer affairs officeMassachusetts residents15Two reports, September 30, 2026

Texas's attorney general lists 51,073 Texans for World Acceptance, posted on October 2, 2026.

Massachusetts logged two reports from World Acceptance on the same day (2026-1681 and 2026-1682), each for 15 residents. Both mark Social Security numbers and driver's license numbers as breached. The record does not say whether the two reports cover the same people.

What happened at World Acceptance?

DateEvent
August 20, 2026Breach date on Indiana's record
September 8, 2026World Acceptance determines that personal information may have been involved (on or about)
September 30, 2026Notices to individuals, Indiana and Massachusetts
October 23, 2026Quarterly results filed with the SEC on Form 8-K

The letter says World Acceptance secured its environment once it learned of the access, investigated, and reviewed the affected information. It does not say when the company learned of the access, how the intruder got in, or what was taken.

What information was involved?

The filed copy names the reader's name and leaves the rest of the list as a blank to fill in. Massachusetts records Social Security numbers and driver's license numbers for its residents. Anyone who got a letter should read the list printed in it.

What is World Acceptance offering?

ItemDetail from the letter
ServiceSingle-bureau credit monitoring, credit report and credit score from Epiq Privacy Solutions ID, with alerts for 24 months from enrollment
ExtraProactive fraud assistance
EnrollmentOnline, following the instructions on page 2 of the letter

The filed copy leaves the response line's number blank, so use the number printed on your own letter. The guide to credit monitoring offers compares offers like this one.

Did World Acceptance tell investors?

Not in any filing so far. World Acceptance files reports with the SEC. Its only 8-K since the breach is its October 23, 2026 results filing under Items 2.02 and 7.01, and it does not mention the incident. There is no Item 1.05 or Item 8.01 8-K about it. The guide to Item 8.01 versus Item 1.05 explains the forms.

What the documents leave open

  • When World Acceptance discovered the intrusion, and how the unknown party got in.
  • Which data elements were involved overall.
  • Whether the 232,401 are current borrowers, former borrowers or applicants.

Other financial services incidents on cisonews.net

All financial services incidents

Sources

  1. 2026-09-30 · AWorld Acceptance Corporation, notice filed with the Massachusetts Office of Consumer Affairs and Business Regulation, published September 30, 2026
  2. 2026-11-08 · AIndiana Attorney General, data breach year-to-date report (2026), published November 8, 2026
  3. 2026-11-08 · AMassachusetts Office of Consumer Affairs and Business Regulation, 2026 Data Breach Notification Report, published November 8, 2026
  4. 2026-10-23 · AWorld Acceptance Corporation, Form 8-K, Items 2.02 and 7.01 (SEC EDGAR), published October 23, 2026
  5. 2026-11-08 · ATexas Attorney General, data security breach reports, published November 8, 2026

Tier A: the organization itself (including notices it filed with a state attorney general), a regulator or SEC EDGAR. Tier B: established press. Each fact on this page carries its supporting passage in the page source.

Entries like this one, in Wednesday’s docket

Wednesdays

Unsubscribe any time.