Upbound probes cybersecurity incidents tied to $13 million in Acima fraud losses

Upbound disclosed an ongoing investigation into cybersecurity incidents that exposed certain non-sensitive customer information and other documents.

The compromised data was used to facilitate fraudulent lease-to-own agreements, driving about $13 million in elevated fraudulent contract losses in Q2 2026 at Acima.

Mitigation steps include stronger authentication controls, expanded fraud monitoring, and other security enhancements coordinated with external cybersecurity experts.

Federal law enforcement was notified; legal or regulatory notifications will follow as warranted by investigation findings.

Based on current facts, the incidents were assessed as not material; materiality will be reassessed if circumstances change.