[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGM8UTrT6xSLP4YgyKuBF-kVlSGxXjcHO0I5SFA-nQ30":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"ecf047da-7801-4a6b-954b-64f0929cad94","Upbound says hack caused $13 million in fraudulent Acima leases","upbound-says-hack-caused-13-million-in-fraudulent-acima-leases-4d491f","The Upbound Group fintech company disclosed that threat actors who stole data from its systems leveraged it to create $13 million in Acima leases. [...]","Fintech company Upbound Group has disclosed a cybersecurity incident where threat actors stole customer data and documents. The attackers used this information to fraudulently create approximately $13 million in leases through Upbound's Acima segment. The company is implementing enhanced security measures and has notified federal law enforcement.","Upbound Group reports a cyberattack led to $13 million in fraudulent Acima leases.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fupbound-says-hack-caused-13-million-in-fraudulent-acima-leases\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F22\u002Fupbound.jpg","2026-07-22T21:43:39+00:00","2026-07-22T22:00:05.850361+00:00",7,[17,20],{"name":18,"type":19},"Upbound Group","vendor",{"name":21,"type":22},"Acima","product","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":25,"name":26,"slug":27},null,"Breaches","breaches",[29,31,36,41],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"a53e88d4-7e4c-481a-b387-3ea4c84f4919","SEC Cyber Rules","sec-cyber",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21],{"controls":49,"vendors":137},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":80,"name":81,"problem":82,"products":83},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"pentera","Pentera","\u002Fvendor-logos\u002Fpentera.png","pentera-platform","Pentera Platform","https:\u002F\u002Fpentera.io\u002Fpentera-platform\u002F","Runs automated, safe attacks in production to validate exploitable attack paths, prioritise proven risk and confirm fixes. Modules cover internal networks, the external attack surface and cloud.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"safebreach","SafeBreach","\u002Fvendor-logos\u002Fsafebreach.png","safebreach-validate","SafeBreach Validate","https:\u002F\u002Fwww.safebreach.com\u002Fvalidate-breach-and-attack-simulation\u002F","Breach and attack simulation with a large library of real attack methods, testing how well controls work across the whole attack chain.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"attackiq","AttackIQ","\u002Fvendor-logos\u002Fattackiq.png","attackiq-enterprise","AttackIQ Enterprise","https:\u002F\u002Fwww.attackiq.com\u002Fproducts\u002Fenterprise\u002F","Continuous, automated adversary emulation across the environment, with full control over scenarios and schedules.",{"slug":109,"name":110,"problem":111,"products":112},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":154},"stolen-customer-data-fuels-13m-in-fraudulent-acima-leases","Stolen Customer Data Fuels $13M in Fraudulent Acima Leases","Threat actors exfiltrated customer data and documents from Upbound Group's systems, then weaponized that information to fraudulently originate approximately $13 million in lease agreements through its Acima division. This attack highlights the cascading financial damage that can result when sensitive customer identity data is not adequately protected — stolen PII becomes a direct tool for financial fraud. The incident also underscores how breaches in fintech environments carry unique downstream risk, as stolen data can be monetized almost immediately through fraudulent financial transactions. Timely detection and response controls are critical to limiting the blast radius once data exfiltration begins.",[143,144,145,146,147,148,149,150,151,152,153],"CIS Control 3 – Data Protection","CIS Control 6 – Access Control Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 SI-4 – Information System Monitoring","NIST SP 800-53 IR-4 – Incident Handling","NIST SP 800-53 SC-28 – Protection of Information at Rest","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach","PCI DSS Requirement 3 – Protect Stored Account Data","FFIEC Cybersecurity Assessment Tool – Cyber Risk Management and Oversight",{}]