:

UPBOUND BREACH FUELS $13M IN FRAUDULENT LEASES

SECURITY DESK1 MIN READ
WED, JUL 22, 2026

■ AI-SUMMARIZED FROM 1 SOURCE ▸ TIMELINE

Upbound Group disclosed that hackers exploited stolen data to create $13 million in fraudulent Acima leases. The fintech company's security breach gave threat actors access to customer information used to establish fake lease accounts.

Upbound Group, parent company of lease-to-own platform Acima, revealed that unauthorized access to its systems resulted in significant fraud. Attackers used the stolen data to generate leases worth $13 million, marking a substantial financial impact from the breach. The company has not yet detailed the scope of compromised information or when the breach occurred. Acima operates by allowing customers to lease goods from retailers with the option to purchase, making customer data valuable for fraudsters seeking to open accounts. Upbound stated it is working with law enforcement and cybersecurity specialists to investigate the incident. The company has notified affected customers and is offering credit monitoring services. This breach highlights growing risks in the fintech sector, where customer data breaches can lead to rapid exploitation through account creation fraud. Details on remediation efforts and whether additional safeguards are being implemented remain limited.

■ SOURCES

Bleeping Computer

■ SUMMARY WRITTEN BY AI FROM THE LINKS ABOVE

■ MORE FROM THE SECURITY DESK

A phishing-as-a-service platform called BigBear 2.0 has successfully circumvented multi-factor authentication defenses to compromise more than 5,000 Microsoft 365 credentials across 258 organizations.

JUST NOWSecurity Desk

Cryptocurrency hardware wallet maker Trezor revealed that an August data breach at logistics provider ShipMonk impacts 81,000 customers total, with an additional 67,000 U.S. customers newly affected.

3H AGOSecurity Desk

Security researchers discovered that LG smart TVs continue recording audio and scanning local networks even when the display is powered down. The findings raise concerns about user privacy and device security.

6H AGOIndustry Desk

ConnectWise has disclosed a new vulnerability in ScreenConnect remote access software without an immediate patch available. The company is offering temporary mitigation measures while preparing a fix for later this week.

6H AGOIndustry Desk

■ SUBSCRIBE TO THE DAILY BRIEF

ONE EMAIL, 5 STORIES, 06:00 UTC. UNSUBSCRIBE ANYTIME.