Upbound Group reports $13 million in losses due to data breach and fraud

Upbound Group, a fintech company, disclosed that a data breach allowed threat actors to steal customer information and documents, which were then used to commit fraud and generate approximately $13 million in fraudulent Acima leases.

The company experienced cybersecurity incidents where certain non-sensitive customer information and other documents were obtained without authorization, according to a recent report by Bleeping Computer.

The breach affected Upbound Group's Acima segment, a lease-to-own (LTO) provider. Threat actors exploited the stolen data to fraudulently obtain goods through Acima's system. Acima paid retailers for these items, but the fraudsters absconded with the merchandise and failed to make payments, leading to the $13 million financial loss in the second quarter.

Upbound Group, formerly Rent-A-Center, is implementing mitigation and remediation measures, including enhanced authentication, fraud detection, and monitoring, with the assistance of cybersecurity experts. Federal law enforcement has been notified, and the company is continuing its investigation. No ransomware groups have claimed responsibility for the attack.

Source: Bleeping Computer