Upbound Group Reports 2026 Data Breach Affecting Customer Data

Upbound Group, Inc., the parent company of brands like Rent-A-Center and Acceptance Now, filed a data breach notice with the Vermont Attorney General on September 26, 2026. As a prominent leader in the rent-to-own and consumer financial services sector, Upbound Group collects and maintains vast repositories of deeply personal and sensitive consumer data to process applications, underwrite lease agreements, and manage financial accounts.

The breach, categorized as an unspecified type, resulted in the exposure of a comprehensive array of sensitive customer data. Information compromised includes Full Name, Social Security Number, Date of Birth, Driver's License Number, Financial Account Number, Routing Number, Credit Score Information, Mailing Address, and Phone Number. This specific combination of data creates significant risks for individuals whose records were involved.

Such an extensive collection of exposed personal and financial data presents multiple avenues for malicious use. The combination of Social Security Number, Date of Birth, and Full Name can be leveraged for sophisticated identity theft, potentially leading to new lines of credit being opened fraudulently. The exposure of Financial Account Number and Routing Number further heightens the risk of unauthorized Automated Clearing House (ACH) withdrawals, fraudulent fund transfers, and other direct financial compromises.

Individuals who receive notification of this incident should take immediate steps to protect themselves. It is recommended to regularly review financial account statements and credit reports for any unauthorized activity. Placing a fraud alert or security freeze on credit files with the major credit bureaus (Equifax, Experian, TransUnion) can help prevent new accounts from being opened fraudulently. Remain vigilant against phishing attempts or other scams that might exploit exposed personal information.