Upbound Group Reports Data Compromise to Vermont Regulators

Upbound Group, Inc., a company operating consumer financial services and rent-to-own brands like Rent-A-Center, reported a data breach incident to the Vermont Attorney General on September 26, 2026. The filing indicates an unauthorized compromise of the company's network infrastructure, which may have exposed a significant volume of sensitive consumer data.

The nature of Upbound Group's business involves collecting extensive personal and financial details to process applications and manage customer accounts. While the specific methodology of the breach remains under investigation, such incidents in the financial services sector often stem from cyberattacks targeting centralized databases that hold valuable consumer profiles.

The compromised data, according to the official report, includes Full Name, Social Security Number, Date of Birth, Driver's License Number, Financial Account Number, Routing Number, Credit Score Information, Mailing Address, and Phone Number. This combination of exposed data poses a high risk for identity theft and financial fraud, as it can be used to open new accounts or gain unauthorized access to existing ones.

Individuals who receive a data breach notification from Upbound Group, Inc. should carefully review the information provided. These notices typically contain details about the breach and offer guidance or resources to help protect against potential misuse of personal information.

To mitigate potential risks, it is advisable for affected individuals to regularly monitor their financial accounts for unauthorized activity. Placing a fraud alert or security freeze on credit reports with major credit bureaus (Equifax, Experian, and TransUnion) can also help prevent new fraudulent accounts from being opened. Additionally, be vigilant against phishing attempts that may try to exploit the compromised information.