Data theft cost Upbound $13M: scammers set up fake leases through Acima

The American fintech company Upbound Group (formerly known as Rent-A-Center) has disclosed details of a cyber incident that resulted in direct financial losses. In a filing with the U.S. Securities and Exchange Commission (SEC), the company reported that attackers had gained unauthorized access to “certain non-sensitive customer information and other documents.”

Upbound operates in the alternative financing and leasing space, bringing together the brands Acima Leasing, Rent-A-Center, Brigit and Upbound Mexico. It was the Acima service — which offers lease-to-own arrangements through third-party retail chains and online stores — that ended up at the center of the story.

How the scheme worked

According to the filing, the attackers used stolen customer data and documents to set up lease-to-own agreements in the customers' names. The mechanics are simple, and that is exactly what makes them so troubling for the company: Acima paid the participating retailers for the goods, the scammers picked up the purchased electronics or other items — and then stopped making lease payments. The result was around 13 million dollars in losses in the Acima segment for the second quarter of this year.

The company's response

Upbound says that immediately after the breach was discovered, it began efforts to contain and remediate the fallout with the help of outside cybersecurity specialists. Among the steps taken were stronger authentication mechanisms, additional fraud-detection tools and improved monitoring. Federal law enforcement was notified of the incident.

The company nonetheless assesses the scale of the attack as not significant enough to influence investment decisions. The investigation is ongoing, and Upbound does not rule out taking additional action based on its findings.

As of publication, no ransomware or extortion group had claimed responsibility for the attack. BleepingComputer reached out to Upbound for clarification — in particular, on the number of affected customers — but had not received a response by the time the article went out.

The case clearly shows that stolen personal data doesn't necessarily have to be sold or published: sometimes it's enough to turn someone else's documents directly into real goods paid for by someone else.

Source: Bleeping Computer