Upbound Group Inc data breach
In September 2026, Upbound Group Inc formally reported a data breach impacting sensitive customer information. Exposed data includes Full Name, Social Security Number, Date of Birth, Financial Account Number, Routing Number, Mailing Address, Phone Number, and Credit and Payment History. Individuals who received a breach notification should understand their options.
Docket sheet
- Company
- Upbound Group Inc
- Venue
- Indiana Attorney General
- Filed
- September 23, 2026
- People affected
- Not stated
- Status
- Monitoring
Where this breach stands
- 1
Breach occurredJuly 3, 2026
Date of the incident as stated in the filing.
- 2
Reported to the Indiana Attorney GeneralSeptember 23, 2026
The company filed a breach notification with the state regulator.
- 3
Attorney reviewCurrent stage
Current status: Monitoring. Our office is reviewing whether affected people may have claims.
- 4
Your case review
Got a letter about this breach? Submit it for a free, confidential review.
Information listed in the filing
- Full Name
- Social Security Number
- Date of Birth
- Financial Account Number
- Routing Number
- Mailing Address
- Phone Number
- Credit and Payment History
Clerk's notes
On September 23, 2026, Upbound Group Inc reported a data security incident to regulators, now under active monitoring. The breach, which occurred on or about July 3, 2026, involves an unauthorized compromise of the company's network infrastructure. This incident affects individuals whose personal information was stored within Upbound Group Inc's systems.
The sensitive personal and financial data exposed in this breach includes your Full Name, Social Security Number, Date of Birth, Financial Account Number, Routing Number, Mailing Address, Phone Number, and Credit and Payment History. The compromise of such comprehensive identifiers places affected individuals at a heightened risk for various forms of identity theft, unauthorized account access, and financial fraud. Unlike some other data, elements like Social Security Numbers are immutable and cannot be easily changed, leading to long-term vulnerability.
As a prominent enterprise operating in the financial services and lease-to-own retail sector, Upbound Group Inc manages extensive consumer portfolios and credit facilities. Companies handling such sensitive data are legally obligated to implement robust security measures to protect consumer information from unauthorized access. The occurrence of this widespread data breach suggests a potential failure in maintaining these mandated security controls, which could lead to legal liability.
If you have received an official notification letter from Upbound Group Inc, it confirms your information was compromised in this security incident. This notice serves as formal acknowledgment that your private data was exposed due to corporate security failures. Understanding your legal rights and options is a crucial next step.
We are currently reviewing the Upbound Group Inc data breach to assess potential legal claims on behalf of affected individuals. You do not need to have already suffered financial fraud to qualify for an evaluation. We offer a free, no-obligation case review to help you understand how this breach might impact you and what legal recourse may be available. Our firm handles these cases on a contingency fee basis, meaning there are no upfront costs or legal fees unless a successful recovery is achieved.
If a notification letter about this breach reached you, see every Indiana data breach on file or browse all cases.
Other Indiana docket entries
- Bozeman School DistrictIndiana AG—Investigation Open
- Bozeman School DistrictIN AG—Investigation Open
- Teamsters Local 17Indiana AG—Investigation Open
- Teamsters Local 17IN AG—Investigation Open
- BankIndiana AG—Investigation Open
- BankIN AG—Investigation Open
- Big Red LiquorsIndiana AGNovember 5, 2026Monitoring
- 5Sites Medical LLCIndiana AGNovember 2, 2026Monitoring
Attorney advertising. A docket entry reflects a public regulator filing and our review status; it does not mean a lawsuit has been filed. Submitting a review request does not create an attorney-client relationship.