- Heights Finance breach exposed sensitive customer data via a compromised third‑party cloud platform
- Stolen records included contact details, financial info, and government identifiers
- Over 700,000 Texans affected; company offers credit monitoring and identity protection
US loan company Heights Finance has revealed it suffered a cyberattack earlier in 2026 in which it lost sensitive data on hundreds of thousands of its customers.
The company published a data breach notification on its website, disclosing that on May 7 2026, it saw an “unauthorized actor” gaining access to a cloud-based platform, hosted by a third party, which the company uses to store certain customer data.
The breach was limited to that cloud platform only and did not affect its loan management system, or other systems and networks.
At least 700,000 victims
As is standard practice in these incidents, Heights Finance notified the relevant authorities and brought in outside cybersecurity help.
The subsequent investigation determined that the attackers – which were not named – stole contact details (names, postal addresses, phone numbers, email addresses), financial information (account details, bank account information such as bank name, account number, routing number), government identifiers (Social Security numbers, tax IDs, driver’s license numbers), and other miscellaneous data.
“Your information may be involved if you received a loan through Heights, or if you inquired about or applied for a loan product (including through a third party),” the company said. “Your information may also be involved if you were a former borrower of Curo Management or any of its former or current related brands.”
The exact number of affected individuals is not known at this time. Heights Finance told regulators in Texas that the breach affected more than 730,000 of its residents, and added that it affected those living in Alabama, Tennessee, Georgia, Texas and South Carolina.
We don’t know which cloud-based platform Heights Finance is using, and the threat actors are yet to claim responsibility for the attack. In the meantime, the company is offering affected customers credit monitoring and identity protection services through Epiq.
