What happened in the Heights Finance Holdings data breach?

Heights Finance Holdings Co. announced a data breach involving a cloud-based platform used to store certain customer information. According to the company’s notice, Heights Finance discovered the incident on May 7, 2026, after determining that an unauthorized actor had gained access to the platform. The affected platform was hosted by a third party and was separate from the company’s internal loan-management systems and other computer networks.

The available notice does not explain precisely how the unauthorized actor obtained access. Heights Finance has not identified the third-party platform provider, disclosed whether stolen credentials or a software vulnerability were involved, or provided the dates when the unauthorized access began and ended. Accordingly, May 7, 2026, should be understood as the date the incident was discovered—not necessarily the date the intrusion first occurred.

Heights Finance reported that the unauthorized actor may have viewed or copied information stored on the cloud platform. The information involved varies by person but may include names, mailing addresses, telephone numbers, email addresses, account details and bank account information, including bank names, account numbers and routing numbers. The affected records may also contain Social Security numbers, tax identification numbers, driver’s license numbers, state identification numbers, dates of birth and personal information voluntarily shared during customer-service communications. Heights Finance’s official notice of data breach does not indicate that every affected person had every category of information involved.

Individuals may be affected if they obtained a loan from Heights Finance or inquired about or applied for a loan, including through a third party. The potentially affected population may also include former borrowers of Curo Management or its current or former related brands. Heights Finance has not publicly disclosed the total number of people affected by the incident. Its notice also states that the approximate number of affected Rhode Island residents was not known when the notice was issued.

After discovering the Heights Finance Holdings data breach, the company activated its incident-response procedures, retained outside cybersecurity specialists and reported the matter to federal law enforcement. Heights Finance stated that its investigation is complete, the affected cloud platform has been secured and there is no continuing security threat. The company also said the incident did not disrupt its operations or affect its loan-management systems or other computer systems and networks.

Heights Finance issued its public data breach notice on August 11, 2026. As of that date, a cybersecurity specialist retained by the company had not found evidence that information connected to the incident had appeared on monitored dark-web forums or marketplaces. This statement addresses the results of the monitoring conducted through the date of the notice and does not establish that the affected information was never viewed, copied or otherwise misused.

Heights Finance is offering 24 months of complimentary credit monitoring and identity-protection services through Epiq’s Privacy Solutions ID program. The services include one-bureau credit monitoring, dark-web monitoring, assistance with credit freezes, change-of-address monitoring, identity-restoration support and lost-wallet assistance. Individuals must first obtain an activation code by calling the company’s dedicated assistance line at 877-343-7785. The deadline to enroll is November 9, 2026. Heights Finance also advises individuals to review their financial accounts and credit reports for suspicious activity and to consider placing fraud alerts or security freezes when appropriate.

How did the Heights Finance Holdings breach occur?

The Heights Finance Holdings data breach occurred when an unauthorized actor gained access to a cloud-based platform hosted by a third party and used by Heights Finance to store customer data. Heights Finance discovered the unauthorized access on May 7, 2026. The company has not disclosed how the attacker entered the platform—such as through compromised credentials, phishing or a software vulnerability—or identified the third-party provider. According to Heights Finance, the incident was limited to the cloud platform and did not affect its loan-management systems or other computer systems and networks. The unauthorized actor may have viewed or copied information stored on the platform. Heights Finance’s Notice of Data Breach

When did the Heights Finance Holdings breach occur?

Heights Finance Holdings discovered the breach on May 7, 2026, when it learned that an unauthorized actor had accessed a third-party cloud platform containing customer data. The company has not disclosed when the unauthorized access began or ended, so May 7 is the discovery date—not necessarily the date the breach initially occurred. Heights Finance publicly announced the incident on August 11, 2026.

How many people were affected by the Heights Finance Holdings breach?

Heights Finance Holdings has not publicly disclosed the total number of people affected nationwide, but according to Texas Attorney General record BR-0005250, the Heights Finance Holdings data breach affected 4,132,834 people nationwide. A Vermont regulatory filing reportedly identified 21 affected Vermont residents, and the Texas Attorney General’s breach-reporting records indicate that 734,828 Texans were affected. The nationwide number of affected individuals remains unconfirmed.

What information was exposed in the Heights Finance Holdings breach?

• The information exposed in the Heights Finance Holdings data breach varied by individual and may have included:
  • Names, mailing addresses, telephone numbers and email addresses
  • Customer account details and related financial information
  • Bank names, bank account numbers and routing numbers
  • Social Security numbers and tax identification numbers
  • Driver’s license numbers and state identification numbers
  • Dates of birth
  • Personal circumstances or other information voluntarily provided during customer-service communications
  According to Heights Finance, the unauthorized actor may have viewed or copied this information from the affected third-party cloud platform. The company did not claim that every category of information was exposed for every affected individual.

Has Heights Finance Holdings offered free credit monitoring and/or identity theft protection services?

Yes. Heights Finance Holdings is offering 24 months of complimentary credit monitoring and identity-protection services through Epiq’s Privacy Solutions ID program to individuals who believe their information may have been involved.

The services include one-bureau credit monitoring, dark-web monitoring, assistance with three-bureau security freezes, change-of-address monitoring, identity-restoration assistance and lost-wallet support. To enroll, individuals must first obtain an activation code by calling 877-343-7785. The enrollment deadline is November 9, 2026. Eligibility may be limited for individuals without established credit, a valid Social Security number or an address in the United States or its territories.

Heights Finance Holdings data breach timeline:

Date	Event
Unknown	An unauthorized actor gained access to a third-party cloud platform used by Heights Finance Holdings to store certain customer information. The company has not disclosed when the access began, how long it continued or how the attacker entered the platform.
May 7, 2026	Heights Finance discovered the unauthorized access. The company activated its incident-response procedures, retained outside cybersecurity specialists and reported the incident to federal law enforcement.
After May 7, 2026	Investigators determined that the unauthorized actor may have viewed or copied personal and financial information from the cloud platform. Heights Finance stated that its loan-management systems, other computer systems and business operations were not affected.
Before August 11, 2026	Heights Finance completed its investigation and secured the affected cloud platform. The company also retained a cybersecurity specialist to monitor dark-web sources for information potentially connected to the incident.
August 11, 2026	Heights Finance issued its public data breach notice. As of that date, the company reported that its monitoring had not found evidence of the affected information on the dark web.
November 9, 2026	Deadline for eligible individuals to enroll in 24 months of complimentary credit monitoring and identity-protection services through Epiq’s Privacy Solutions ID program.

Who is Heights Finance Holdings?

Heights Finance Holdings Co. is a consumer credit lender headquartered in Greenville, South Carolina. The company provides secured and unsecured personal installment loans and related financial services through an online platform and a network of branch locations across 13 states. Heights Finance Holdings operates several consumer-facing brands, including Heights Finance, Covington Credit, Quick Credit and Southern Finance, serving borrowers seeking financing for expenses such as debt consolidation, vehicle repairs, medical bills and home improvements. About: Heights Finance

What should you do if you received a Heights Finance Holdings data breach letter?

• If you received a Heights Finance Holdings data breach letter, first review it carefully to determine which categories of your information may have been involved. You should then take the following precautions:
  • Enroll in the complimentary protection services. Heights Finance is offering 24 months of credit monitoring and identity-protection services through Epiq. Obtain an activation code by calling 877-343-7785 and enroll before November 9, 2026. Verify enrollment information through the official Heights Finance Holdings Notice of Data Breach rather than an unsolicited link.
  • Freeze your credit with all three credit bureaus. A credit freeze is free, does not affect your credit score and can help prevent someone from opening new credit accounts in your name. Unlike a fraud alert, a freeze must be placed separately with Equifax, Experian and TransUnion. FTC credit-freeze guidance.
  • Review your credit reports and financial accounts. Obtain reports through AnnualCreditReport.com and look for unfamiliar accounts, inquiries or debts. Continue monitoring bank, credit-card and loan accounts for unauthorized transactions.
  • Contact your bank if financial information was exposed. If your notice identifies a bank account number or routing number, tell the bank that the information was involved in a data breach. Ask whether the account should be restricted, monitored or replaced.
  • Secure important online accounts. Use unique passwords and enable multifactor authentication on your email, banking, credit-card and tax-related accounts. Be alert for phishing calls, emails or text messages that refer to Heights Finance or claim that additional personal information is needed.
  • Document and report suspected identity theft. Keep the breach letter and records of any suspicious activity or related expenses. If your information is misused, contact the relevant financial institution promptly and file a report at IdentityTheft.gov to obtain a personalized recovery plan.

Heights Finance Holdings Data Breach Notice

The notice describes the Heights Finance Holdings data breach, including the type of information that may have been involved and the steps offered to affected individuals.

Open the Heights Finance Holdings Data Breach Notice in a New Tab

Sources and additional information about the data breach:

• • Heights Finance Holdings Website
  • Heights Finance Holdings Notice of Data Breach
  • Texas Data Security Breach Reports
  • Vermont Security Breach Notices
  • FTC: What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach
  • FTC Consumer Advice: Identity Theft
  • IdentityTheft.gov
  • IRS Identity Theft Guide for Individuals
  • U.S. Department of Health and Human Services Office of Inspector General: Medical Identity Theft
  • IdentityTheft.gov: What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach

Class Action FAQ

About This Data Breach Resource

This page was created to give affected individuals and researchers a clear, comprehensive explanation of the Heights Finance Holdings data breach. It summarizes what is currently known about the incident, including the timeline, how the breach was discovered, the types of information involved, the number of people affected when available, important notice dates, and steps individuals may want to take after receiving a data breach notification.

This resource is independently written and organized to help readers understand the breach without having to review multiple notices, state attorney general filings, company statements, and related materials. When available, this page relies on primary sources and identifies key facts, unanswered questions, and updates as new information becomes public.

This page is especially relevant for readers searching for information about the Heights Finance Holdings data breach, Heights Finance Holdings data breach notice, Heights Finance Holdings class action investigation, what information was exposed, how many people were affected, and what affected individuals should do next.

Abington Cole + Ellery reviews data breach incidents involving sensitive personal information, financial information, and protected health information. This page is intended to help affected individuals understand the publicly reported facts, the types of information that may have been involved, and practical steps that may reduce the risk of identity theft or medical identity theft.

The information on this webpage is provided for general informational purposes only and does not constitute legal advice. Nothing on this page should be relied upon as legal advice for any particular situation. Submitting information through this page does not create an attorney-client relationship.

For more information about steps you can take to possibly reduce the risk harm arising from a data breach, please review the following article: What are some steps you can take if you've been the victim of a data breach?

This website is not associated with nor authorized by Heights Finance Holdings or any affiliated companies. If you have received any other data breach notifications, you may want to review Abington Cole + Ellery's current list of data breach investigations.