DataBreachCaseFile.com

Case file

Case File: Upbound Group, Inc. Data Breach

This file collects the dated facts on record for the Upbound Group, Inc. incident. The state report is dated September 27, 2026. The incident itself is dated July 3, 2026.

Timeline

86 days separate the incident date from the date it was reported.

  1. July 3, 2026Incident dateWhen the filing says the breach took place.
  2. September 27, 2026Report filed in CaliforniaDate the notice was lodged with the California Attorney General.

Case facts

Filing state
California
Date reported
September 27, 2026
Incident date
July 3, 2026
Receiving office
California Attorney General

Data categories in the file

  • Full Name
  • Social Security Number
  • Date of Birth
  • Financial Account Number
  • Routing Number
  • Mailing Address
  • Credit and Payment History
  • Driver License Number

Case notes

Upbound Group, Inc., a consumer services and lease-to-own retail holding company, formally reported a data security incident to the California Attorney General on September 27, 2026. This filing confirms an unauthorized compromise of its network environment, which was initially detected on July 3, 2026.

While the exact method of attack is under ongoing investigation, the nature of Upbound Group's business involves handling extensive sensitive personal and financial consumer data for applications, credit evaluations, and payment processing. The company's public filing indicates this incident involved unauthorized access to systems holding such information.

The exposed data categories include Full Name, Social Security Number, Date of Birth, Financial Account Number, Routing Number, Mailing Address, Credit and Payment History, and Driver License Number. The compromise of these details creates significant risks for affected individuals, including potential identity theft and various forms of financial fraud.

Individuals who receive notification about this incident are advised to take protective measures. These include placing a fraud alert or security freeze on their credit reports with all three major credit bureaus. It is also recommended to regularly review financial account statements and credit reports for any suspicious activity and to be vigilant against unsolicited communications requesting personal information.

Questions about this case file

Where does the Upbound Group, Inc. case file come from?
Every entry is taken from the breach report Upbound Group, Inc. lodged with the California Attorney General. Nothing here is estimated.
Why do the incident date and the report date differ?
Companies usually investigate before they report. The gap between the two dates shows how long that took.
What does the records-affected figure count?
It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.
Does this case file change over time?
Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

More California case files

California data breaches

Filing source: California Attorney General