TECHNOMALIST
US loan provider Heights Finance has published a data breach notice confirming that an unauthorized actor gained access to a third-party cloud platform on May 7, 2026. According to the company, the incident affected only that platform and did not compromise its loan management system or other internal networks. The notice was made public on the company's website, and Heights Finance said it notified relevant authorities and brought in outside cybersecurity specialists to investigate.
The investigation concluded that the unnamed intruders stole several categories of sensitive information. Contact details exposed include names, postal addresses, phone numbers, and email addresses. Financial records such as bank name, account number, and routing number were also taken. Government identifiers—including Social Security numbers, tax IDs, and driver’s license numbers—were among the data lost, along with other miscellaneous information.
Heights Finance stated that individuals may be affected if they received a loan through the company, or if they inquired about or applied for a loan product, including through a third party. The notice also says former borrowers of Curo Management or any of its former or current related brands may be impacted. This broad eligibility language suggests the exposure could extend beyond current Heights Finance customers, though the company has not confirmed the total number of people involved.
In a regulatory filing with Texas authorities, Heights Finance reported that more than 730,000 residents of Texas were affected. The company added that the breach also involves people in Alabama, Tennessee, Georgia, and South Carolina. It is not clear from the available information whether the Texas figure represents the entire affected population or only the Texas portion; the company describes the total as “not known at this time.”
Heights Finance has not named the cloud-based platform involved, and no threat actor has claimed responsibility for the attack. The company is offering affected customers credit monitoring and identity protection services through Epiq. The notice does not state whether Heights Finance or the third-party host was responsible for securing the compromised environment, and the method of unauthorized access has not been described.
This disclosure involves a combination of financial account data and government identifiers, which is often considered high-risk in data breach notifications. The company’s public notice and regulator communication provide the primary factual basis for this report. Readers should note that some details, such as the exact number of affected individuals and the identity of the attackers, have not yet been established.
See an error? Read our corrections policy or email [email protected].
