People who received an Upbound Group data breach notice in September 2026 may be covered by proposed class actions alleging Upbound, the parent of Rent-A-Center and Acima, failed to protect names and Social Security numbers taken from its cloud files in July 2026. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes class action complaints. The statements below are unproven allegations. Upbound Group, Inc. and Acima Digital, LLC have not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
Upbound Group, Inc., the company formerly known as Rent-A-Center, Inc. and the owner of the Acima lease-to-own business, began mailing data breach notices on September 23, 2026. Its notice letter says the company learned on July 13, 2026 that an unauthorized third party had accessed files stored in cloud applications, and that its investigation found the third party obtained files containing personal information between July 3 and July 6, 2026.Two proposed class actions followed in the U.S. District Court for the Eastern District of Texas: Dunnam v. Upbound Group, Inc., No. 4:26-cv-01413, filed September 30, 2026 against Upbound and Acima Digital, LLC, and Dec v. Upbound Group Inc., No. 4:26-cv-01457, filed October 8, 2026. Both allege Upbound failed to adequately protect customers’ personal information. Upbound has not responded to the claims in court, and none of them have been proven.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Upbound’s Notice Says
According to a sample of the notice letter Upbound filed with California’s attorney general, the company “immediately took steps to investigate and mitigate” the incident, brought in a cybersecurity firm, and put containment and remediation measures in place. The letter offers one year of complimentary Experian IdentityWorks credit monitoring, which can be activated with a code printed in each letter until December 31, 2026.The notice does not say how many people were affected. The first lawsuit says Acima serves roughly 1.5 million to 2 million customers a year, but that is not a count of people in the breach. Upbound also notified Massachusetts regulators around September 29, according to the second complaint.
What the Lawsuits Claim
The September 30 complaint says names and Social Security numbers were compromised and that Upbound did not begin notifying people until more than 90 days after the breach began. It argues the free credit monitoring is not enough to cover the risk of identity theft, and brings claims for negligence, negligence per se, breach of implied contract, invasion of privacy, unjust enrichment and breach of fiduciary duty. It proposes a nationwide class of everyone in the United States whose information was compromised in the breach Upbound and Acima discovered in July 2026.The October 8 complaint names Upbound, doing business as Get It Now, and proposes a class of all persons whose information Upbound held and was compromised in the breach. Both cases are assigned to U.S. District Judge Michael J. Truncale and seek damages and court-ordered security improvements.
What Happens Next?
Upbound has not answered either complaint. There is no settlement, no certified class and no claim form. OCA’s data breach hub tracks other recent breach cases.Questions
What happened in the Upbound data breach?
According to Upbound’s notice letter, the company learned on July 13, 2026 of a cybersecurity incident in which an unauthorized third party gained access to files stored in cloud applications. Its investigation found the third party obtained files containing personal information between July 3 and July 6, 2026.
What information was exposed in the Upbound breach?
Upbound’s notice letters list the specific information involved for each person. The first lawsuit says the exposed information includes names and Social Security numbers.
Is Upbound offering credit monitoring?
Yes. The notice letter offers one year of complimentary Experian IdentityWorks credit monitoring, which can be activated with the code in the letter until December 31, 2026.
Is there any money to claim from the Upbound lawsuits?
No. There is no settlement, certified class or claim form. If the cases settle or a class is certified, class members would be notified of any way to take part.
Sources
• Class Action Complaint — Dunnam v. Upbound Group, Inc., U.S. District Court for the Eastern District of Texas, Case No. 4:26-cv-01413 (filed September 30, 2026), via CourtListener: Complaint (PDF)• Class Action Complaint — Dec v. Upbound Group Inc., U.S. District Court for the Eastern District of Texas, Case No. 4:26-cv-01457 (filed October 8, 2026), via CourtListener: Complaint (PDF)
• California Attorney General, Upbound Group, Inc. data breach report and sample notice letter: California AG
