Skip to content
Leak-site post naming acima, captured by ThreatCluster

acima

iah6477

Ransomware leak-site victim intelligence

Data size
2.1 TiB
Files
541,209
Posted
Aug 20, 2026
Countdown
hosted until 2026-09-26 19:42 UTC · 1d 23h left
Country
US
Industry
Financial Services

Summary

Written by ThreatClusterfrom site fields, file listing, leak post, screenshot, our reporting

iah6477 states that Acima's data totals 2.1 TiB across 541,209 files and 3 folders, published as a public archive split into 10 zip parts (acima-part1of10.zip through acima-part10of10.zip). The leak page notes the archive is hosted until 2026-09-26 19:42 UTC and currently shows a countdown of 27d 19h. ThreatCluster's reporting notes Upbound Group faced a $13 million loss from data breach and fraudulent leases via Acima segment, disclosed in an SEC filing.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms
entra_id m365 salesforce

What was taken

archive: PUBLIC · free download. 10-part zip archive for/acima with 3 folders: entra_id (entra_id/), m365 (m365/), salesforce (salesforce/); 541,209 files totaling 2.1 TiB across 3 folders.

Data categories
entra_idm365salesforce
File types seen
zip × 10
Sample files (10)
acima-part1of10.zip
acima-part2of10.zip
acima-part3of10.zip
acima-part4of10.zip
acima-part5of10.zip
acima-part6of10.zip
acima-part7of10.zip
acima-part8of10.zip
acima-part9of10.zip
acima-part10of10.zip

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

parts
10 parts (each opens on its own)
archive
PUBLIC · free download
hosted_until
2026-09-26 19:42 UTC

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture