Heights Finance Holdings has confirmed a data breach affecting a third-party cloud platform, potentially exposing sensitive personal, financial, and identity information for current and former customers, as well as individuals who merely inquired about loan products. The company discovered the unauthorized access on May 7 and initiated an investigation, which concluded that an intruder may have viewed or copied data from the environment.
The breach notification indicates that the exposed data could include names, home addresses, phone numbers, email addresses, and dates of birth. More critically, the compromised information may also contain financial details such as bank names, account numbers, and routing numbers, alongside government identifiers like Social Security numbers, tax identification numbers, driver’s license numbers, or state ID numbers. Additionally, personal circumstances voluntarily disclosed during customer service interactions could have been exposed.
Heights Finance filed a report with Texas regulators, indicating that 734,828 individuals were affected. However, this figure may not represent the total number of affected individuals nationwide, as Heights Finance operates in multiple states including Alabama, Tennessee, Georgia, Texas, and South Carolina.
The incident extends beyond direct Heights Finance customers. Individuals who inquired about or applied for a loan product, including through a third party, may also be impacted. Furthermore, some customers of the former parent company, CURO Management, and its present or former related brands are potentially affected.
The combination of Social Security numbers, dates of birth, addresses, and bank account details presents a significant risk for identity fraud, financial fraud, and account takeover attempts. The exposure of personal circumstances shared with customer support staff could also enable more persuasive and potentially harmful social engineering scams.
Heights Finance advises individuals who receive a notification letter to follow the instructions provided and enroll in the offered protection services. For those who believe they fall into an affected group but do not receive a notice, the company recommends using the contact details published on its official website for inquiries, rather than relying on unsolicited communications or sponsored search results.
