DataBreachCaseFile.com

Case file

Case File: Upbound Group, Inc. Data Breach

This file collects the dated facts on record for the Upbound Group, Inc. incident. The state report is dated September 26, 2026.

Timeline

  1. September 26, 2026Report filed in VermontDate the notice was lodged with the Vermont Attorney General.

Case facts

Filing state
Vermont
Date reported
September 26, 2026
Receiving office
Vermont Attorney General

Data categories in the file

  • Full Name
  • Social Security Number
  • Date of Birth
  • Driver's License Number
  • Financial Account Number
  • Routing Number
  • Credit Score Information
  • Mailing Address
  • Phone Number

Case notes

Upbound Group, Inc., the parent company of brands like Rent-A-Center and Acceptance Now, filed a data breach notice with the Vermont Attorney General on September 26, 2026. As a prominent leader in the rent-to-own and consumer financial services sector, Upbound Group collects and maintains vast repositories of deeply personal and sensitive consumer data to process applications, underwrite lease agreements, and manage financial accounts.

The breach, categorized as an unspecified type, resulted in the exposure of a comprehensive array of sensitive customer data. Information compromised includes Full Name, Social Security Number, Date of Birth, Driver's License Number, Financial Account Number, Routing Number, Credit Score Information, Mailing Address, and Phone Number. This specific combination of data creates significant risks for individuals whose records were involved.

Such an extensive collection of exposed personal and financial data presents multiple avenues for malicious use. The combination of Social Security Number, Date of Birth, and Full Name can be leveraged for sophisticated identity theft, potentially leading to new lines of credit being opened fraudulently. The exposure of Financial Account Number and Routing Number further heightens the risk of unauthorized Automated Clearing House (ACH) withdrawals, fraudulent fund transfers, and other direct financial compromises.

Individuals who receive notification of this incident should take immediate steps to protect themselves. It is recommended to regularly review financial account statements and credit reports for any unauthorized activity. Placing a fraud alert or security freeze on credit files with the major credit bureaus (Equifax, Experian, TransUnion) can help prevent new accounts from being opened fraudulently. Remain vigilant against phishing attempts or other scams that might exploit exposed personal information.

Questions about this case file

Where does the Upbound Group, Inc. case file come from?
Every entry is taken from the breach report Upbound Group, Inc. lodged with the Vermont Attorney General. Nothing here is estimated.
Why do the incident date and the report date differ?
Companies usually investigate before they report. The gap between the two dates shows how long that took.
What does the records-affected figure count?
It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.
Does this case file change over time?
Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

More Vermont case files

Vermont data breaches

Filing source: Vermont Attorney General