Heights Finance, a debt consolidation loan company, has confirmed a data breach affecting approximately 734,828 individuals. The incident, discovered on May 7, involved unauthorized access to a third-party cloud-based platform used by the company to store customer data.
The compromised information includes a range of sensitive personal and financial details. This encompasses contact information such as addresses, banking data including account and routing numbers, and government identification numbers like Social Security numbers, tax IDs, driver’s license numbers, or state IDs. Additionally, any personal information shared during customer service interactions was also exposed.
Heights Finance, headquartered in Greenville, South Carolina, operates over 285 offices across 11 states, including Alabama, Tennessee, Georgia, Texas, and South Carolina. The company stated that the breach was limited to the cloud platform and did not impact its loan management systems or other internal computer networks. Following the discovery, the company asserts that the cloud platform has been secured and there is no ongoing security threat.
The breach impacts individuals who have either received a loan from Heights Finance or inquired about a loan product through a third party. It also affects some customers of its parent company, Curo Management, and related brands.
Heights Finance has engaged a cybersecurity firm to monitor the dark web for any evidence of the stolen data. As of the company's most recent statement, no such evidence has been found on dark web forums, marketplaces, or other platforms. No specific hacking group has publicly claimed responsibility for the attack.
The company has issued a warning to affected customers and notified regulators in Texas about the incident.
