Upbound Group, a fintech company, has disclosed that a cybersecurity incident led to approximately $13 million in fraudulent lease-to-own agreements through its Acima Leasing segment. The company, formerly known as Rent-A-Center, stated in a U.S. Securities and Exchange Commission (SEC) filing that unauthorized actors obtained certain non-sensitive customer information and other documents from its systems.
The stolen data was subsequently used to facilitate fraudulent transactions within Acima's lease-to-own program. Acima Leasing offers payment options through various third-party retailers and e-commerce platforms. In these fraudulent cases, the attackers used the compromised customer data to acquire goods, for which Acima then paid the participating retailers. The fraudsters, however, absconded with the merchandise and failed to make the required lease payments, resulting in the reported financial losses during the second quarter of this year.
Upbound Group operates several brands in the alternative finance and rental sector, including Acima Leasing, Rent-A-Center, Brigit, and Upbound Mexico. The company confirmed that the incident's impact was concentrated within its Acima segment.
Upon detecting the breach, Upbound Group initiated immediate mitigation and remediation efforts. These actions included engaging external cybersecurity experts to assist with the response. The company has implemented enhanced authentication controls, introduced additional fraud-detection mechanisms, and improved its monitoring capabilities to prevent future occurrences.
Federal law enforcement authorities have been notified of the incident, and Upbound Group is continuing its investigation. The company indicated that further actions might be taken based on the ongoing findings. So far, evidence suggests the cyberattack was not significant enough to affect investment decisions.
At present, no ransomware groups or data extortion actors have publicly claimed responsibility for the attack on Upbound Group. The company has not yet disclosed the number of customers potentially affected by the data compromise.
