GoKawiilThe Upbound Group fintech company disclosed that threat actors who stole data from its systems leveraged it to create $13 million in Acima leases.
In a filing with the U.S. Securities and Exchange Commission (SEC), the company says that it "experienced cybersecurity incidents in which certain non-sensitive customer information and other documents were obtained without authorization."
The threat actor used the information to commit fraud in lease-to-own agreements, resulting in financial losses of about $13 million in the Acima segment in the second quarter of this year.
Upbound Group, formerly known as Rent-A-Center, provides financial solutions and lease-to-own (LTO) products. It is an important player in the alternative finance and rental sector that operates the Acima Leasing, Rent-A-Center, Brigit, and Upbound Mexico brands.
Acima provides lease-to-own payment options through third-party retailers and e-commerce sites.
According to the SEC filing, the attacker used stolen customer data and documents to obtain goods through Acima’s lease-to-own system under fraudulent agreements.
Acima paid the participating retailers for those goods, but the fraudsters took the merchandise and failed to make the required lease payments, resulting in approximately $13 million in losses.
The company says that immediately after detecting the hack, it began implementing mitigation and remediation measures with the help of external cybersecurity experts.
These measures include enhanced authentication controls, additional fraud-detection mechanisms, and improved monitoring.
Moreover, federal law enforcement authorities were notified accordingly. Upbound continues to investigate the incident and will take additional action depending on the findings.
... continue reading