Heights Finance Holdings Co., a U.S. consumer finance company, has begun notifying over 1.2 million individuals that their personal and financial data was exposed following a cybersecurity incident. The breach, discovered on May 7, 2026, involved unauthorized access to a third-party cloud platform used by Heights Finance to store customer information.
According to the company's notification, the unauthorized activity was confined to this specific cloud-based platform and did not affect Heights Finance's internal loan management systems or other computer networks. Upon discovery, Heights Finance immediately initiated its incident response protocols, engaged external cybersecurity specialists to investigate the breach, and reported the incident to federal law enforcement.
The company has confirmed that the compromised cloud platform has since been secured and that there is no ongoing security threat. Heights Finance stated that its operations were not impacted by the incident and have continued without disruption.
The exposed data varies by individual but may include contact details, financial and bank account information, government identification numbers, and dates of birth. The affected population includes current Heights Finance customers, loan applicants, individuals who inquired about the company's products, and former borrowers of Curo Management and related brands.
Heights Finance is offering affected individuals 24 months of complimentary credit monitoring and identity protection services. The company also noted that its dark web monitoring efforts have not yet found any evidence that the stolen data has been published or made available.
As of the current reporting, no specific threat actor or ransomware/extortion group has claimed responsibility for the breach, nor have any known groups been linked to the incident.
