Loading story…
Upbound Group disclosed that attackers gained unauthorized access to certain non-sensitive customer information and other documents, and the stolen data was later used to create fraudulent lease-to-own agreements through its Acima segment. The company said the abuse of that information contributed to roughly $13 million in elevated fraudulent contract losses in the second quarter, as fraudsters allegedly obtained goods through Acima while participating retailers were paid and the leases went unpaid.
Upbound said it launched mitigation and remediation efforts after detecting the incidents, including stronger authentication controls, added fraud detection and monitoring, and other security improvements with support from external cybersecurity experts. The company notified federal law enforcement and said its investigation remains ongoing; it has not identified the attackers publicly, no ransomware or extortion group had claimed responsibility, and the company said that based on its current understanding it does not believe the incidents are material, though that assessment could change.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
In a Form 8-K dated July 21, 2026, Upbound Group disclosed the cybersecurity incidents, the related fraudulent Acima lease activity, and its response measures. The company said that based on its current understanding, it did not believe the incidents were material, though that assessment could change.
The company said it notified federal law enforcement after the incidents came to light. Upbound also stated that its investigation remains ongoing.
Upbound said information taken in the incidents was later used to facilitate fraudulent lease-to-own agreements through its Acima segment. The company attributed approximately $13 million in elevated fraudulent contract losses during the second quarter of 2026 to this activity.
Upbound Group said it recently identified cybersecurity incidents involving unauthorized access to certain non-sensitive customer information and other documents. After identifying the compromise, it began mitigation and remediation efforts including enhanced authentication, additional fraud detection and monitoring, and other security improvements with help from external cybersecurity experts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
7 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcescworld.com
Open sourcesecurityweek.com
Open sourcecyberveille.ch
Open sourcecyberveille.ch
Open sourcebleepingcomputer.com
Open sourcesec.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity agencies from the United States, United Kingdom, Australia, New Zealand, and Singapore warned that threat actors were actively exploiting multiple **Accellion File Transfer Appliance (FTA)** vulnerabilities to compromise organizations worldwide. The campaign abused `CVE-2021-27101`, `CVE-2021-27102`, `CVE-2021-27103`, and `CVE-2021-27104` to deploy a web shell, execute commands, steal data, and erase logs, affecting government and private-sector victims across medical, legal, telecommunications, finance, and energy sectors. Authorities said some intrusions led to data theft and extortion, identified suspicious outbound traffic to `194.88.104[.]24` and `45.135.229[.]179`, and urged organizations to isolate affected systems, collect forensic images, reset credentials and tokens, upgrade to version `9_12_432` or later, and migrate away from the end-of-life platform. One disclosed victim was **Morgan Stanley**, which said attackers breached the Accellion FTA server of third-party vendor **Guidehouse** and stole encrypted files tied to stock plan participants. The attackers also obtained the decryption key, exposing sensitive data including names, addresses, dates of birth, Social Security numbers, and corporate company names, while Morgan Stanley said its own internal applications were not compromised. Reporting linked the broader Accellion intrusion wave to **FIN11** and the **Clop** ransomware operation, underscoring how exploitation of a legacy file-transfer appliance cascaded into downstream third-party data breaches and extortion risk.
Aug 15, 2026
Apollo Global Management disclosed a data breach after attackers gained unauthorized access to certain cloud platforms and stole personal information from its systems. The firm said the intrusion occurred between July 6 and July 10 and exposed data including names, dates of birth, contact details, home addresses, and Social Security numbers, according to its filing with the California attorney general. The breach appears linked to a broader extortion campaign targeting major U.S. financial institutions and private equity firms. Reporting tied the activity to social engineering tactics including fake IT helpdesk calls, spoofed login portals, and theft of passwords and multi-factor authentication codes. Apollo said it has notified law enforcement, engaged outside cybersecurity and forensic specialists, and is offering affected individuals identity protection and credit monitoring while the investigation continues.
Aug 25, 2026
Uber Freight said it is investigating a data security incident involving unauthorized access to parts of its systems and repositories after the **Helix** extortion group listed the company on its leak site and claimed to have posted nearly 1 million files online. Reports said the alleged haul included data from mailboxes, OneDrive accounts, and the accounts receivable department, although Uber Freight did not confirm the authenticity of the leaked material. The company said the intrusion was identified, contained, and remediated, and that business operations were not disrupted. Uber Freight also said it had engaged federal law enforcement as the incident drew links to a wider campaign targeting prominent U.S. companies. Researchers cited in the reports tied Helix to a broader extortion ecosystem associated with **BlackFile** and the **UNC6671** cluster, which has been linked to credential theft through vishing and device-code phishing and to follow-on access into cloud services such as **Microsoft 365** and, in some cases, **Okta** environments.
Aug 13, 2026