Heights Finance Holdings Co., a consumer lender based in Greenville, South Carolina, has notified customers that an unauthorized third party accessed a cloud-based platform used to store certain customer information. Companies entrusted with sensitive financial and personal data have a responsibility to safeguard it against unauthorized access.
Heights Finance’s Data Breach Investigation
Heights Finance Holdings Co. operates as a consumer credit lender through several brands, including Heights Finance, Covington Credit, Quick Credit, and Southern Finance. On May 7, 2026, the company discovered that an unauthorized actor had gained access to a cloud-based platform hosted by a third-party vendor that Heights used to store certain customer data. According to the company’s public notice, this activity was limited to the cloud-based platform itself and did not affect Heights’ internal loan management systems or other computer networks.
Upon discovering the incident, Heights activated its incident response protocols, engaged outside cybersecurity specialists, and reported the matter to federal law enforcement. The company’s investigation determined that the unauthorized actor may have viewed or copied certain information stored on the platform, though the specific data involved varies by individual. Heights has stated that its investigation is now complete, that the cloud-based platform has been secured, and that there is no ongoing security threat to its systems.
The breach was reported to the Vermont Attorney General on August 11, 2026, which identified 21 Vermont residents as affected by the incident. Heights also appears to have made notifications to attorneys general in other states, including California, Iowa, Maine, Montana, New Hampshire, Oregon, Rhode Island, South Carolina, Texas, and Washington, since multi-state breach notifications of this kind are typically filed in parallel with several states’ regulators rather than through a single centralized filing. A company-wide total of affected individuals has not yet been made public; only the Vermont-specific figure has been confirmed through a state AG filing at this time.
Heights has indicated that individuals whose information may have been involved include not only current and former Heights customers, but also anyone who inquired about or applied for a loan product through Heights, including through a third party, as well as former borrowers of Curo Management or any of its former or current related brands. This broad scope suggests that the affected data set may span several years and multiple points of contact with the company’s lending business.
Data breaches involving consumer lenders and financial services companies have become increasingly common, in part because these companies routinely collect and retain some of the most sensitive categories of personal information, including Social Security numbers, bank account and routing numbers, government-issued identification numbers, and detailed financial histories. This makes lenders and their third-party data vendors attractive targets for cybercriminals, since a single successful intrusion into a centralized data-storage platform can expose records belonging to thousands of borrowers and applicants at once, rather than requiring an attacker to compromise each individual’s information separately.
The combination of information reportedly exposed in this incident, names, Social Security numbers, financial account details, and government identification numbers, is particularly valuable to identity thieves. Social Security numbers combined with financial account information can enable attackers to open new lines of credit, redirect existing account funds, or file fraudulent tax returns in a victim’s name. Government identification numbers such as driver’s license or state ID numbers can be used to create fraudulent identification documents or to pass identity-verification checks at other institutions. When these data categories are exposed together, the risk of long-term identity theft is generally considered higher than when only a single data category, such as an email address, is involved.
Heights has taken some standard steps in response to the breach, including offering affected individuals two years of complimentary credit monitoring and identity protection services through a third-party provider. Companies that experience a data breach involving financial and identification information are generally expected to take such remedial steps and notify affected individuals and applicable state regulators within a reasonable time after discovering an intrusion, though state notification-timeline requirements vary. Here, the roughly three-month gap between the company’s discovery of the incident in May 2026 and its public notification in August 2026 reflects time spent on forensic investigation to determine what specific information was involved, a common feature of breach investigations though notification delays can leave affected individuals more vulnerable during the interim period.
When Did This Breach Occur?
Heights discovered the unauthorized access to its third-party cloud platform on May 7, 2026. The company’s forensic investigation concluded before it began notifying affected individuals, with notification letters and public disclosures going out around August 11, 2026. Heights reported the incident to the Vermont Attorney General on that same date, identifying 21 Vermont residents as affected. The company has not disclosed the exact date on which the unauthorized access to the platform first began, only the date on which it was discovered.
What Information Was Breached?
According to Heights’ notice, the specific information involved varies by individual but may include one or more of the following: names, home addresses, phone numbers, and email addresses; financial account details, including bank account numbers and routing numbers; government-issued identifiers such as Social Security numbers, tax identification numbers, driver’s license numbers, and state ID numbers; and additional information such as dates of birth or personal details voluntarily shared during customer service interactions. Individuals who received a loan through Heights, inquired about or applied for a loan including through a third party, or were a former borrower of Curo Management or a related brand, may have had their information involved.
What You Can Do
Heights is offering affected individuals two years of complimentary credit monitoring and identity protection services through a third-party provider, Epiq. The service includes single-bureau credit monitoring with alerts, dark web monitoring, credit protection assistance, change-of-address monitoring, and identity restoration support. Individuals who believe they may be affected can call Heights’ dedicated call center to receive an activation code and enroll before the deadline.
- Enroll in the free credit monitoring and identity protection services offered by Heights before the enrollment deadline.
- Regularly review bank and credit card statements for unfamiliar transactions.
- Request a free credit report from each of the three major credit bureaus and review it for unauthorized accounts.
- Consider placing a fraud alert or security freeze on your credit file with Equifax, Experian, and TransUnion.
- Report any suspected identity theft to the Federal Trade Commission at IdentityTheft.gov.
File a Data Breach Lawsuit Against Heights Finance
If your personal or financial information was exposed in the Heights Finance data breach, you may have legal options available to you. Companies that collect and store sensitive customer data are expected to implement reasonable safeguards to protect that information from unauthorized access.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
