World Acceptance Corporation, a consumer finance company based in Greenville, South Carolina, has disclosed a data security incident. The company says names, Social Security numbers and driver’s license numbers may have been subject to unauthorized access, and the Texas Attorney General’s public listing shows 51,073 Texans affected.
Lenders collect detailed personal information when people apply for credit, and they have a responsibility to protect it and to notify people promptly when it may have been exposed. Here is what is publicly known so far about the World Acceptance Corporation data breach.
World Acceptance Corporation’s Data Breach Investigation
World Acceptance Corporation is a consumer installment lender headquartered at 104 South Main Street in Greenville, South Carolina. In a notice posted on its website and dated September 30, 2026, the company said it became aware of unauthorized activity in its network on or about August 24, 2026.
According to the company, it began an investigation right away and worked with outside cybersecurity professionals. After what it called an extensive forensic investigation and a comprehensive review of the affected data, it confirmed on or about September 8, 2026 the names and addresses of the impacted individuals and the nature of the impacted data. The company said the data may have been subject to unauthorized access or acquisition on or around August 24, 2026.
The company says the impacted information may have included a name, a Social Security number and a driver’s license number, and that not all information was impacted for each individual. It says it has no evidence that any personal information has been or will be used for identity theft as a direct result of the incident. Beginning on September 30, 2026, it notified individuals for whom it had valid mailing addresses, and it offered complimentary credit monitoring to people whose Social Security numbers were potentially involved. It also set up a call center for questions.
On October 2, 2026, an entry for the company appeared in the Texas Attorney General’s public data security breach report listing, which the state publishes for incidents affecting 250 or more Texas residents. That entry reports 51,073 Texans affected, lists name, Social Security number information and driver’s license number as the categories involved, and states that notice was given by U.S. Mail, by a posting on the company’s website, and by publication in print media. The company’s own notice also reports that 2 Rhode Island residents were affected. Reporting separate state-by-state figures is a normal part of the regulatory process, and the company has not published a single nationwide total that we have been able to find.
The public record does not describe how the unauthorized access occurred, which systems were involved, or whether any group has claimed responsibility. We are not drawing any conclusion about the cause, and nothing here should be read as saying more than the company and the regulator have said.
The roughly five weeks between the date the company says it became aware of the activity and the start of mailed notices is not unusual for an incident that requires a forensic review of many files. Notification laws generally require notice without unreasonable delay after an organization determines that personal information was involved, and the company says it confirmed the nature of the data on or about September 8, before mailing began. A report to a regulator is not an admission of fault, but it shows the company concluded the incident met the legal bar for notification.
The combination of a name, a Social Security number and a driver’s license number is among the most useful sets of information for fraud. With those items, a criminal may try to open credit accounts, take out loans, file a false tax return, apply for benefits, or pass identity checks with a bank or mobile carrier. Because a lender’s records tie a person to a financial relationship, messages that appear to come from the company about a loan, payment or account can also be especially convincing. A Social Security number cannot easily be replaced, which is why exposure of this kind can carry risk for years.
The company also advises affected individuals to consider a fraud alert or security freeze on their credit files, to obtain free credit reports, and to review account statements regularly. If you received a letter, keep it with your records and note the credit monitoring enrollment deadline. If you did not receive a letter but have borrowed from or applied to the company, contact it using details you have verified independently, such as the company’s published call center number from its website, rather than a number in an unexpected message.
We will update this page if the company or a regulator publishes more information, such as how the incident occurred or the nationwide number of people notified.
When Did This Breach Occur?
World Acceptance Corporation says it became aware of unauthorized activity in its network on or about August 24, 2026, and that data may have been subject to unauthorized access or acquisition on or around that date. It says it confirmed the affected individuals and the nature of the data on or about September 8, 2026.
The company began mailing notices on September 30, 2026, and its notice was posted that day. The Texas Attorney General listing for the incident was published on October 2, 2026.
What Information Was Breached?
The company says the impacted information may have included a name, a Social Security number and a driver’s license number, and that not all information was impacted for each individual. The Texas filing lists the same categories.
The company has not said whether any financial account or loan information was involved. A notification letter should describe the information involved in your own case. The company has offered complimentary credit monitoring to people whose Social Security numbers were potentially involved.
What You Can Do
If you think you may be among the people affected, or you have applied for or held a loan with World Acceptance Corporation, consider these steps:
- Watch your mail for a notice from World Acceptance Corporation and keep it for your records.
- Enroll in the free credit monitoring if you were offered it, and note the enrollment deadline in your letter.
- Check your credit reports for free at annualcreditreport.com and consider a fraud alert or a free credit freeze with Equifax, Experian and TransUnion.
- Review bank and card statements and loan accounts for activity you do not recognize.
- Be cautious of calls, texts and emails about your loan or account, and verify any request by using a phone number you already know.
- Consider an IRS Identity Protection PIN, and report suspected identity theft to the Federal Trade Commission.
File a Data Breach Lawsuit Against World Acceptance Corporation
If you received a notice that your information was involved in the World Acceptance Corporation data breach, you may be entitled to compensation. Companies are expected to take reasonable steps to protect the personal information they hold, and people affected by a breach can face a lasting risk of identity theft and fraud.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
