Upbound Group Reports $13 Million Fraud Loss Following Cyberattack on Acima Leasing Upbound Group, a fintech company specializing in lease-to-own (LTO) financial solutions, disclosed a cybersecurity incident in an SEC filing that led to $13 million in fraudulent Acima leases. The breach, detected earlier this year, involved unauthorized access to non-sensitive customer data and internal documents, which threat actors exploited to secure fraudulent lease agreements. The attackers used the stolen information to obtain goods through Acima’s lease-to-own system, bypassing payment obligations. While Acima reimbursed participating retailers for the merchandise, the fraudsters absconded with the goods without making lease payments, resulting in a $13 million loss for the company in Q2 2024. Upbound, formerly known as Rent-A-Center, operates multiple brands, including Acima Leasing, Rent-A-Center, Brigit, and Upbound Mexico. Acima provides LTO payment options via third-party retailers and e-commerce platforms. Upon discovering the breach, Upbound implemented remediation measures with external cybersecurity experts, including enhanced authentication controls, fraud-detection systems, and improved monitoring. Federal law enforcement was also notified. The company continues to investigate the incident but has stated that the attack’s impact was not material enough to influence investment decisions. No ransomware or data extortion groups have claimed responsibility for the breach, and details on the number of affected customers remain undisclosed. Upbound has not responded to media inquiries for further information.