Heights Finance Holdings is notifying more than 1.2 million individuals that their personal and financial information was accessed during a data breach involving a third-party cloud-based storage platform. The company discovered the unauthorized access in early May and subsequently launched an investigation with the assistance of outside cybersecurity specialists.
The compromised data includes a wide range of sensitive identifiers, such as full names, home addresses, email addresses, and phone numbers. Additionally, the breach exposed government-issued identification, including Social Security numbers, tax identification numbers, and driver’s license numbers. Financial details, such as bank account numbers, routing numbers, and specific account information, were also accessed by the unauthorized party.
According to reports filed with state attorneys general, the impact is widespread across multiple states. While initial reports focused on a figure of approximately 734,828 individuals in Texas, updated filings indicate the total number of affected people exceeds 1.2 million, including 486,463 in South Carolina, 26 in New Hampshire, and 21 in Vermont. The breach potentially affects current Heights Finance customers, individuals who inquired about or applied for loans, and former borrowers associated with CURO Management or its related brands.
Heights Finance stated that the incident was confined to the third-party cloud environment and did not impact its internal loan management systems or broader corporate networks. The company has since secured the platform and reported the incident to federal law enforcement. While the lender is monitoring the dark web for signs of the stolen data, it has not identified the specific threat actor responsible for the intrusion.
To assist those affected, the company is offering 24 months of complimentary credit monitoring and identity protection services. Customers are advised to follow the specific instructions provided in the official notification letters sent by the company. Heights Finance has cautioned individuals to verify any communication regarding the breach through official channels rather than relying on links or contact information found in unsolicited messages.