Upbound Group disclosed unauthorized acquisition of customer records and internal documents subsequently leveraged in fraudulent attempts.
Item 1.05 Material Cybersecurity Incident disclosure filed by Upbound Group, Inc. detailing unauthorized access to corporate network systems and customer leasing accounts.
Official statutory regulatory filing submitted by Upbound Group to State of California Department of Justice pursuant to applicable data breach disclosure mandates.
The Upbound Group cybersecurity event represents a confirmed Network Intrusion & Data Exfiltration within the Retail & Consumer Goods sector, attributed to the Unknown / Unattributed cyber threat collective. Discovered through technical indicators and regulatory breach filings, the event resulted in unauthorized access to sensitive internal IT environments, with the exact population scope undergoing regulatory audit.
Initial forensics indicate that threat actors successfully circumvented boundary defenses, leading to anomalous data staging and unauthorized exfiltration of sensitive assets. Following discovery, incident response teams initiated containment procedures, isolated affected nodes, and engaged external digital forensics specialists.
Forensic telemetry and statutory disclosure filings confirm exposure of the following sensitive asset categories:
In adherence to statutory breach notification mandates, official filings have been registered with federal and state regulatory authorities to inform affected stakeholders and oversight bodies. Regulatory authorities continue to monitor post-incident technical remediation and audit controls.
SEC Form 8-K Item 8.01 Disclosure: Upbound Group reveals unauthorized acquisition of non-sensitive customer records and corporate documents.
California Attorney General Data Breach Disclosure Notice
This incident record is a flat Markdown file tracked in Git. Propose an update or add a milestone via Pull Request.
