Progressive Leasing progleasing.com Progressive Leasing data breach: what happened and what to do
Progressive Leasing, a lease-to-own company, reported a September 2023 cyberattack that its Maine filing says affected 193,055 people. Names, Social Security numbers, addresses, phone numbers, birth dates and email addresses were exposed.
View all 13,115 breaches- Breach date
- 9 Sept 2023
- Made public
- 23 Oct 2023
- Affected
- 193,055
- Data exposed
- Names, Social security numbers, Physical addresses, Phone numbers, Dates of birth, Email addresses
- Last updated
What happened
Progressive Leasing is a lease-to-own company that finances furniture, electronics and other goods through retail partners. Its notice says that on September 11, 2023, it experienced a cybersecurity incident affecting some of its systems. Preliminary findings put the intruder's first access to the network at September 9, 2023.
On October 23, 2023, the company filed a notice of data breach with the Maine Attorney General and began notifying people. The filing gives the total number affected as 193,055, with 488 of them in Maine. The company also filed with other states. A figure of 2,582 residents in one state turned up in a state list, but that counts a single state, not the whole breach.
What was exposed
According to the Maine filing as summarized by JD Supra, the information included names, Social Security numbers, addresses, phone numbers, dates of birth and email addresses. The notice was addressed to current and former customers and employees.
That set covers what a criminal needs for identity theft: a Social Security number tied to a name, address and birth date. The phone number and email give scammers a way to reach you with a message that mentions your lease.
The company's response
Progressive Leasing offered complimentary credit monitoring and identity protection services to people it notified. Lawsuits over the incident were consolidated in federal court in Utah, and the company's parent has reported a settlement payment of $3.3 million covered by cyber insurance.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze stops anyone from opening new credit in your name. It's free and takes a few minutes each at Equifax, Experian and TransUnion. Lift it when you apply for credit yourself.
- 2
Use the credit monitoring offer in your letter
The letter includes an enrollment code and a deadline. It's free, and it alerts you to new accounts under your Social Security number.
- 3
Check your credit reports
Pull your free reports at annualcreditreport.com and look for accounts or inquiries you don't recognize.
- 4
Expect texts and emails that mention your lease
Messages about a payment, a late fee or a refund that ask you to log in or pay by link are suspicious. Go to the company's site or app yourself, or call the number on your agreement.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up. It can't remove data that already leaked, so the steps above matter most.
Frequently asked
Was I affected by the Progressive Leasing data breach?
The company notified 193,055 people, including customers and employees past and present. If you got a letter dated around October 23, 2023, you were affected.
What was exposed?
Names, Social Security numbers, addresses, phone numbers, dates of birth and email addresses.
Is there a settlement?
Progressive Leasing's parent reported a $3.3 million settlement payment of the consolidated class action, covered by cyber insurance. Check the settlement administrator's site for claim details.
Should I change my password?
Passwords weren't listed as exposed. If you use the same one for your lease account and elsewhere, change it anyway.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
