Heights Finance Data Breach: Third-Party Cloud Exposure and Confirmed Impact

Incident summary

A newly consolidated count shows that the Heights Finance Holdings Co. data breach affects at least 1.2 million people. The incident involved unauthorized access to a third-party cloud platform used to store customer data, with exposed categories ranging from names and contact details to Social Security numbers, government-issued IDs, and bank-account information.

Heights Finance discovered the unauthorized access on May 7, 2026 and published a notice on August 11. Reporting published on August 18 combined public state notifications for 734,828 people in Texas, 486,463 in South Carolina, 26 in New Hampshire, and 21 in Vermont—a minimum total of 1,221,338 people.

The company said the incident was limited to the cloud platform and did not affect its loan-management systems, other internal computer systems, or business operations. The separation matters: an organization can keep its core service running while customer data stored by an outside platform is still exposed.

Disclosed facts

Discovery and response

Heights Finance said an unauthorized actor gained access to a cloud platform hosted by a third party and used to store certain customer data. After discovering the activity, the company activated its incident-response procedures, engaged outside cybersecurity specialists, and reported the matter to federal law enforcement.

The affected platform was secured, the investigation was completed, and the company said there was no ongoing threat at the time of its public notice. The incident did not disrupt business operations and did not reach the company’s loan-management systems or other internal networks.

Affected information

The data varied by person. Disclosed categories include names, mailing addresses, telephone numbers, email addresses, account details, bank names, account and routing numbers, Social Security and tax identification numbers, driver’s-license and state-ID information, dates of birth, and information voluntarily provided during customer-service interactions.

These categories can support several forms of abuse when combined. Contact details make impersonation more convincing, identity data can be used in account-verification attempts, and financial details can support targeted fraud or unauthorized account activity. Recipients should base their response on the specific categories listed in their individual notice.

• Names, addresses, phone numbers, and email addresses
• Social Security numbers, tax IDs, and dates of birth
• Driver’s-license and state-issued identification data
• Bank names, account numbers, routing numbers, and account details
• Information submitted through loan applications or customer-service interactions

Minimum affected count

The Texas Attorney General’s public breach listing records 734,828 affected Texans and identifies names, addresses, Social Security numbers, driver’s-license data, government-issued ID data, financial information, dates of birth, and other information among the reported categories.

SecurityWeek combined publicly reported counts from four states: 734,828 in Texas, 486,463 in South Carolina, 26 in New Hampshire, and 21 in Vermont. Those figures total 1,221,338 people, so the most defensible description is at least 1.2 million affected individuals rather than a complete nationwide total.

Affected population

The notice covers more than current borrowers. People may be affected if they received a Heights Finance loan, asked about or applied for a loan—including through a third party—or were former borrowers of Curo Management or one of its related brands.

That scope shows why data retention must be assessed across the full customer lifecycle. Declined applicants and former customers may still have sensitive information stored in application, support, or archival systems even when they no longer have an active account.

Practical checks

Notice recipients

1. Confirm whether you received an official Heights Finance notice and review the data categories listed for you.
2. Enroll in the offered 24 months of credit monitoring and identity-protection services through the official notice channel.
3. Review credit reports for inquiries, accounts, loans, or address changes you did not initiate.
4. Consider a credit freeze or fraud alert if the affected data includes identity or financial identifiers.
5. Monitor bank and card accounts for small test charges, new payees, unexpected transfers, and contact-detail changes.

Verify any phone number or enrollment address against Heights Finance’s official notice before providing information. Criminals who know a person’s name and lending relationship can impersonate the company and ask for passwords, one-time codes, payments, or additional identity documents.

Financial and identity monitoring

• New loans, cards, inquiries, and address changes on credit reports
• New payees, direct debits, or small authorization charges
• Unexpected password resets and authentication codes
• Changes to phone numbers, email addresses, or mailing addresses
• Advance-payment requests framed as refunds, protection, or debt servicing

Long-lived identifiers such as Social Security numbers and bank-account details require monitoring beyond a one-time password reset. Credit-file alerts, transaction notifications, and contact-detail change alerts should remain enabled so that attempted misuse can be identified early.

Organization checks

• Data inventories for each third-party cloud service, including retention and deletion rules
• Administrator, support, and service-account access with recent sign-in history
• Audit logs for bulk search, export, download, and API activity
• Contractual notification deadlines and requirements for forensic evidence
• Storage locations for applications, support records, and uploaded documents outside core systems

Incident-response plans should cover third-party evidence preservation as well as internal systems. Customers need enough information to determine what data was viewed or copied, which accounts and paths were used, and how the notification population was calculated.

Impact

The incident demonstrates that a large confidentiality breach can occur without a service outage. At least 1.2 million people are included in the consolidated public counts, and the data categories span contact, identity, and financial information. That combination calls for coordinated credit, account, and impersonation monitoring.

Heights Finance is offering 24 months of complimentary credit monitoring and identity-protection services. Recipients should pair that service with direct bank-account monitoring and independent verification of messages that claim to concern the breach.

Relevance for Korean organizations

Although the public notices concern U.S. borrowers and applicants, the control lesson applies to Korean financial, fintech, and customer-service organizations that use external cloud platforms. Applications and support records may be copied outside core transaction systems, and information tied to former customers or unsuccessful applicants can remain in retained datasets.

Organizations should document data and access by provider, obtain evidence of deletion after the business purpose ends, and preserve logs for bulk queries, exports, downloads, and support-account activity. Vendor assessments are more useful when they test detection, notification, and evidence delivery rather than relying only on annual questionnaires.

Sources

[Heights Finance Holdings Co. notice of data breach]

https://www.heightsfinance.com/importantinfo/

[Texas Attorney General data security breach reports]

https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage?email_hash=0d7a7050906b225db2718485ca0f3472

[SecurityWeek state-by-state affected count]

https://www.securityweek.com/heights-finance-data-breach-impacts-at-least-1-2-million-individuals/

Evidence cutoff: public company, regulator, and reporting records available through August 18, 2026 at 11:59:59 PM KST.

More SECUFOCUS incident analysis and response guidance is available at secufocusnow.com.

https://secufocusnow.com