Heights Finance Breach Exposes SSNs, Banking Data of 734,828 Customers

Cybercriminals breached a third-party cloud platform used by Heights Finance in early May, compromising the sensitive financial and personal data of approximately 734,828 customers. The Greenville, South Carolina-based debt consolidation lender, which operates more than 285 offices across 11 states under brands in Alabama, Tennessee, Georgia, Texas, and South Carolina, disclosed the incident to Texas regulators on Friday and published a customer notice last week. The stolen trove includes contact details, banking information such as account and routing numbers, and government identification documents ranging from Social Security numbers and tax IDs to driver's license and state ID numbers — alongside any personal data shared during customer service interactions. Customers of parent company Curo Management and its related brands were also caught up in the intrusion.

Heights Finance said the breach was discovered on May 7 when an attacker gained unauthorized access to a cloud-based storage platform hosted by an unnamed third-party vendor. The company emphasized that the activity was isolated to that cloud environment and did not reach its core loan management systems or internal networks. "We have since confirmed that the cloud-based platform is secure and that there is no ongoing security threat," the firm stated. No hacking group has claimed responsibility, and Heights Finance has engaged an external cybersecurity firm to monitor dark web forums, marketplaces, and other platforms for evidence of the stolen data — none has surfaced as of the company's latest statement.

The breach affects not only Heights Finance borrowers but also anyone who merely inquired about a loan product through a third party. Given the scope of exposed identifiers, affected individuals should immediately verify whether their credentials appear in other known incidents using a reliable email breach checker and rotate any reused banking passwords, testing their strength with a password checker. Those concerned about residual exposure should also run a comprehensive privacy checkup to identify lingering metadata leaks. Heights Finance was previously sued by the federal government for allegedly targeting borrowers struggling to repay existing loans, generating revenue from fees on frequent refinancers — a case dismissed shortly after the current administration took office.