Heights Finance Breach Exposed Sensitive Data for More Than 1.2 Million People
A data breach is bad. A data breach involving Social Security numbers, bank account information, driver’s license numbers, and dates of birth is the kind where the details matter quite a bit more than the phrase “we take your privacy seriously.”
Heights Finance says it discovered on May 7 that an unauthorized actor had gained access to a third-party cloud platform the company used to store customer data. Heights published its public breach notice on August 11. Based on notifications filed with state attorneys general, SecurityWeek reports that at least 1.2 million people are affected.
The company’s notice says the information involved varies by person, but may include names, addresses, phone numbers, email addresses, bank names, account and routing numbers, Social Security or tax identification numbers, driver’s license or state ID numbers, dates of birth, and other information customers provided. That is a particularly useful collection of information for identity theft and financial fraud.
Heights says the incident was limited to the third-party cloud platform and did not affect its loan-management systems or other networks. It also says its investigation is complete, the platform is now secure, and its monitoring provider had not found the stolen information on the dark web as of the company’s notice.
That last part is reassuring, but only to a point. “We have not found it for sale” is not the same thing as “nobody copied it.” Heights itself says the attacker may have viewed or copied the information. Once Social Security numbers and bank-account details may have left the building, the sensible response is to treat them as potentially compromised.
The notice applies not only to people who currently have a Heights Finance loan. It may include people who merely inquired about or applied for a loan, including through a third party, as well as some former borrowers of Curo Management and related brands.
Heights is offering 24 months of credit monitoring and identity-protection services through Epiq to people who believe their information was involved. The enrollment deadline is November 9, 2026. The company also recommends reviewing financial accounts and credit reports and considering fraud alerts or security freezes.
If you have done business with Heights or one of the related companies, this is worth taking seriously even if you have not seen suspicious activity yet. Identity theft often has a much longer shelf life than the news cycle.
