VULNpocalypse
InformationalBreach / campaignMonitoring

SEC EDGAR headline says PROG Holdings disclosed cyber incident in 8-K filing

An SEC EDGAR headline says PROG Holdings disclosed a cyber incident in an 8-K; details are not confirmed, so watch for official company notices.

Published
Exploitation
Not confirmed, the available source text does not describe exploitation, attacker activity or data access

What happened

A headline attributed to SEC EDGAR says that PROG Holdings, Inc. discloses a cyber incident in an SEC Form 8-K filing. The headline is dated October 28, 2026.

The document at that URL is Exhibit 99.1, which is PROG Holdings’ third quarter 2026 earnings release (SEC EDGAR). The part of the exhibit available to us covers financial results, the company’s outlook and a share repurchase plan. It does not mention a cyber incident. The disclosure therefore rests only on the headline, and its wording could not be checked against the filing text.

The available source does not confirm any of the following:

  • What kind of incident occurred, and when.
  • Which systems or subsidiaries were involved.
  • Whether any customer, employee or partner data was accessed.
  • Who was responsible, and how they gained entry.
  • Whether there was any operational or financial impact.

No independent reporting or third-party verification appears in the sources available for this advisory.

The exhibit describes PROG Holdings as a fintech holding company headquartered in Salt Lake City. It owns Progressive Leasing, Four Technologies, MoneyApp and Purchasing Power (SEC EDGAR).

Am I affected?

Not confirmed. The available source does not say which customers, users or systems were involved, if any.

What to do now

  1. Read the 8-K filing and its exhibits on SEC EDGAR for any statement the company makes about the incident.
  2. If you use Progressive Leasing, Four, MoneyApp or Purchasing Power, watch for direct notification from the company. Do not assume your data is involved unless the company says so.
  3. As a general precaution, not drawn from the source: treat unexpected messages that mention this incident with caution, and contact the company only through channels you already know.

Sources