Upbound Group says data breach fueled $13 million in fraudulent leases. Upbound Group, Inc., a Texas-based consumer finance company, disclosed that a recent breach of its computer systems led to millions of dollars in fraudulent contract losses tied to its lease-to-own business. In a filing with the U.S. Securities and Exchange Commission, Upbound said it experienced cybersecurity incidents in which non-sensitive customer information and other documents were obtained without authorization. The company said it believes that information was later used to set up fraudulent lease-to-own agreements, driving elevated fraudulent contract losses of approximately $13 million within its Acima segment during the second quarter of 2026. Upbound provides lease-to-own and flexible payment products through several brands, including Rent-A-Center, Acima, Brigit and Upbound Mexico. The company, formerly known as Rent-A-Center, operates as a significant participant in the alternative finance and rental industry. Its Acima brand extends lease-to-own payment arrangements through partnerships with third-party retailers and e-commerce platforms. According to the SEC filing, those behind the intrusion used the stolen customer data and documents to obtain merchandise through Acima's lease-to-own system by entering into fraudulent agreements. Acima paid participating retailers for the goods involved, but the individuals who obtained the merchandise did not make the required lease payments, producing losses of roughly $13 million. Upbound said it began mitigation and remediation work as soon as the intrusion was detected, working alongside outside cybersecurity specialists. Those efforts have included strengthening authentication controls, adding fraud-detection tools and expanding system monitoring. The company also notified federal law enforcement of the incidents. Upbound said its investigation remains ongoing and that it may take further action depending on what that investigation finds. As of the time of its SEC disclosure, the company said the evidence gathered so far indicates the incidents are not material. It remains unclear who carried out the intrusion. No known cybercrime group has listed Upbound on a data leak site, and no ransomware or extortion group has publicly claimed responsibility for the attack.

Cybersecurity daily brief - Thursday, July 23, 2026. Here are today's top cybersecurity stories for Thursday, July 23, 2026. Check Point CVE-2026-16232: Actively Exploited SmartConsole Zero-Day Gets CISA Deadline of July 25 Check Point Software has patched an authentication bypass in its SmartConsole GUI, tracked as CVE-2026-16232 (CVSS 9.1), after confirming active exploitation against management servers exposed to the internet. An unauthenticated attacker obtains a login token granting full administrator access to the Security Management Server, enabling security policy modification or firewall rule deletion without any credentials. CISA added the flaw to its Known Exploited Vulnerabilities catalog and set a July 25, 2026 remediation deadline for federal agencies. BleepingComputer RefluXFS CVE-2026-64600: 9-Year-Old Linux XFS Race Condition Exposes 16.4 Million Systems to Root Takeover Qualys has disclosed RefluXFS, a race condition in the Linux kernel's XFS filesystem copy-on-write path dating back nine years, which lets any local user overwrite protected files and gain root privileges. The exploit leaves no kernel log output, survives reboots, and bypasses SELinux Enforcing mode, affecting RHEL, Oracle Linux, Amazon Linux, and Fedora Server across an estimated 16.4 million systems. The upstream kernel fix merged on July 16, 2026, and distributions are actively issuing backported patches. BleepingComputer Chaos Ransomware Deploys msaRAT Backdoor Hiding C2 Traffic Inside Chrome and Edge Browsers Cisco Talos has documented msaRAT, a Rust-based remote access trojan used by the Chaos ransomware group, which routes encrypted command-and-control traffic through headless Chrome or Edge processes via WebRTC and Cloudflare developer infrastructure. The malware controls the browser through the Chrome DevTools Protocol, making C2 traffic indistinguishable from ordinary browser cloud activity and invisible to most network-layer detection tools. Chaos operators gain initial access through spam floods, vishing, and Quick Assist abuse before deploying the backdoor. Cisco Talos JadeProx: China-Nexus Espionage Cluster Used TriBack Loader Against Governments and Hospitals Across Asia and Latin America Group-IB has published research on JadeProx, a China-nexus threat cluster uncovered when an exposed Alibaba Cloud server in Singapore was found holding operational data, including a previously undocumented Windows loader called TriBack Loader. Confirmed intrusions include a Vietnamese public hospital's medical imaging system, Malaysia's Ministry of Foreign Affairs, and a spear-phishing package targeting the National Congress of Honduras. The cluster used Chinese offensive tooling including iox, Neo-reGeorg, suo5, nuclei, and fscan for tunneling, pivoting, and mass reconnaissance. The Hacker News Upbound Group Says Acima Breach Led to $13 Million in Fraudulent Lease-to-Own Agreements Upbound Group, parent company of lease-to-own service Acima, disclosed a data breach in which stolen customer records were used to generate approximately $13 million in fraudulent lease agreements during Q2 2026. Attackers obtained customer information without authorization and placed fake lease-to-own orders, with Acima paying out merchandise to fraudsters who then disappeared without making payments. The company has notified federal law enforcement and implemented enhanced authentication controls and fraud-detection mechanisms. BleepingComputer South Korea Discloses 10-Month Diplomatic Academy Breach Exposing Data of Up to 10,000 Foreign Ministry Personnel South Korea has disclosed a data breach at the Korea National Diplomatic Academy lasting approximately ten months from April 2025 to February 2026, in which attackers exploited a zero-day vulnerability to access personal data of up to 10,000 current and former Ministry of Foreign Affairs employees, including overseas diplomats. Compromised records include names, user IDs, email addresses, encrypted passwords, positions, and departmental affiliations, though no sensitive identification numbers or internal government systems were accessed. South Korea's National Intelligence Service detected the breach in February 2026, and no confirmed misuse has been reported. BleepingComputer GitHub Actions Weaponized to Exploit cPanel CVE-2026-41940 Authentication Bypass at Scale Across Hosting Infrastructure Attackers compromised a PHP developer's GitHub account and injected 583 malicious GitHub Actions workflow files across ten Packagist packages between July 12 and 13, 2026, turning the PHP ecosystem into distributed scanning and exploitation infrastructure. Each workflow launches a GitHub-hosted runner, downloads an architecture-specific payload, and targets exposed cPanel and WHM servers through CVE-2026-41940, a critical authentication bypass, to harvest server credentials and administrative secrets. Internet-facing hosting environments running unpatched cPanel and WHM installations are the primary targets. The Hacker News Researchers Expose SharedRoot: Claude Cowork Sandbox Escape Lets Attackers Access Host Mac and Windows Filesystems Security researchers have disclosed SharedRoot, a sandbox escape vulnerability in Anthropic's Claude Cowork, which chains exploitation of CVE-2026-46331 in the agent's guest Linux kernel to break out of the VM and read or write files across the host Mac filesystem as the logged-in desktop user. A separate Windows variant exploits design flaws in the CoworkVMService RPC interface to achieve root-level command execution inside the Hyper-V-isolated Ubuntu VM. Anthropic has patched both variants. The Hacker News Adobe Patches HermeticReader CVE-2026-48294: Flaw in 329-Million-Install Acrobat Extension Exposed WhatsApp Web Chats Adobe has patched CVE-2026-48294 in its Acrobat Chrome extension, a flaw allowing a malicious website to inject a form into WhatsApp Web, capture the live chat body, and submit rendered messages, contact names, and conversation previews to an attacker-controlled server. The attack required no malware, no stolen credentials, and no WhatsApp vulnerability - a victim simply visiting a malicious page while signed into WhatsApp Web with the affected extension installed was sufficient. The extension has approximately 329 million installs, and Adobe released a patch within one weekend of responsible disclosure. SecurityWeek Theori Finds 434 Exploitable Vulnerabilities in 28 AI-Generated Applications Theori has published research on vibe-coded applications built across multiple AI models and development environments, identifying 434 verified exploitable security vulnerabilities after runtime testing and source-code review. The most common issues were insufficient rate limiting, insecure direct object references (IDOR), server-side request forgery (SSRF), and directory traversal, with modern AI models producing fewer SQL injection flaws but consistently missing authorization controls and secrets management. Five models from Anthropic and OpenAI were used across both greenfield and brownfield development scenarios. SecurityWeek Stay tuned for today's in-depth analysis posts. Enjoy this article? Don't forget to share.

Upbound: Data breach led to $13M fraud in Acima segment. Upbound Group says a recent data breach caused about $13 million in fraudulent lease-to-own contract losses in its Acima segment in Q2 2026. Upbound Group Inc., a Texas-based consumer finance company, reported a cybersecurity incident that led to roughly $13 million in fraudulent lease-to-own contract losses in its Acima segment during the second quarter of 2026, according to an SEC filing. The filing states attackers obtained non-sensitive customer information and other documents that were subsequently used to open fraudulent lease-to-own agreements, contributing to the losses in the Acima business. Upbound notified law enforcement and retained external cybersecurity experts to strengthen its systems. The company says its investigation is ongoing and that, at the time of the SEC disclosure, it did not view the incidents as material to the business overall. The filing did not name any perpetrators and noted there were no public claims on known cybercrime leak sites when the disclosure was made. Upbound did not detail whether it has made remedial payments to affected customers, whether customers will receive direct notifications beyond the SEC filing, whether ransom demands were involved, or whether all compromised access points have been fully secured. A newly launched tracker, the Hacker in a Hoodie (HIH) Index, aims to catalog material data breaches to help security teams and policymakers monitor incidents. Forensic work will be required to determine precisely how the fraud was carried out and whether additional customer protections or system changes are needed. Upbound operates lease-to-own and flexible payment services under brands including Rent-A-Center, Acima and Brigit.