Upbound Group, Inc. reported that it learned of unauthorized access to files in cloud applications on July 13, 2026. Its sample notice says files were obtained between July 3 and July 6, 2026. The incident was reported to state regulators, including Vermont and California; Vermont’s breach notice listing reports 42 affected residents on September 26, 2026.
The information identified in public materials includes names and Social Security numbers. The total number of affected people across all states has not been disclosed, and the Vermont count is not the company-wide total. Public materials do not confirm exposure of medical records or financial account information.
Further details about the incident and the number of affected people may emerge as notices and regulatory records are updated. The available records do not establish when consumers were first notified.