Consumer lender Heights Finance Holdings Co. has confirmed that an unauthorized actor accessed a third-party cloud platform holding customer data, exposing Social Security numbers, bank account and routing numbers, government IDs and free-text customer service notes. Heights discovered the intrusion on May 7, 2026 and published its breach notice on August 11, 2026, a gap of more than three months. Victim counts vary substantially by source: The Record puts the figure at roughly 750,000 based on the company's Texas regulator filing, while SecurityWeek and Security Affairs report more than 1.2 million by summing notifications filed with multiple state Attorneys General. Heights itself has not published a nationwide total. No threat actor has been named, and no attack technique has been disclosed by the company or any reporting outlet.
What Happened
According to Heights Finance's own notice of data breach and its August 11 press release, the company discovered on May 7, 2026 that "an unauthorized actor gained access to a cloud-based platform hosted by a third party that we use to store certain customer data." Heights states the activity was confined to that platform and "did not affect any of our loan management systems or other computer systems or networks."
The company says it activated incident response protocols, engaged outside cybersecurity specialists, and reported the incident to federal law enforcement. It has since declared the cloud platform secure with "no ongoing security threat," and says operations were never disrupted.
Heights Finance Holdings is a consumer credit lender headquartered in Greenville, South Carolina, offering personal installment loans to borrowers who often have limited access to traditional bank credit. The Record reports it operates dozens of personal loan companies across Alabama, Tennessee, Georgia, Texas and South Carolina. Emery Reddy, a plaintiffs' law firm tracking the incident, states that Heights also operates under the Covington Credit, Quick Credit and Southern Finance brands; that brand list appears only in that lower-tier source and should be treated as unverified.
Critically, the exposure window extends well beyond current customers. Heights says information may be involved for anyone who received a loan, inquired about or applied for a loan product including through a third party, or who was "a former borrower of Curo Management or any of its former or current related brands." Malwarebytes notes the notice therefore reaches people who may have no recollection of any relationship with a company called Heights Finance.
Counting the Victims: The Figures Do Not Agree
There is no single authoritative victim count, and the reporting reflects that honestly rather than converging.
- 734,828 is the confirmed Texas Attorney General figure, filed August 14, 2026 and cited consistently by SecurityWeek, The Record, Malwarebytes and Emery Reddy.
- ~750,000 is The Record's headline number, which treats the Texas filing as the practical scale of the incident.
- More than 1.2 million is the figure reported by SecurityWeek and Security Affairs, derived from adding state-level Attorney General notices together: 734,828 in Texas, 486,463 in South Carolina, 26 in New Hampshire and 21 in Vermont.
Malwarebytes explicitly cautions that the Texas figure "should not automatically be read as a confirmed nationwide total," given the company's multi-state footprint. Emery Reddy notes Heights has not disclosed a nationwide figure at all. The 1.2 million total is an aggregation performed by security press across partial state filings, not a company-stated number, and additional state notifications could push it higher. Defenders and downstream fraud teams should plan against the upper bound, not the headline.
What Was Taken
Heights' own notice and press release describe four categories of potentially viewed or copied data, with specifics varying by individual:
- Contact details: name, address, phone number, email address.
- Financial information: account details, bank account information including bank name, account number and routing number, and related financial data.
- Government identifiers: Social Security number, tax ID, driver's license number, or state ID number.
- Additional information: date of birth, plus information voluntarily provided by consumers, including "personal circumstances shared during customer service interactions."
That last category is the one most likely to be underestimated. A subprime lending call log is not a routine CRM record. It can contain narrative detail about medical bills, job loss, divorce, repossession risk or family emergencies, volunteered by borrowers to justify a loan or a payment deferral. That material is not covered by credit monitoring and cannot be reissued the way a card number can.
The rest of the set is a near-complete identity kit. Name, date of birth, SSN, driver's license number and a live bank account plus routing number together support synthetic identity creation, new-account fraud, ACH-based account takeover and highly credible pretexting. Malwarebytes flags precisely this combination as what makes the incident unusually dangerous relative to a generic PII spill.
Heights says its dark web monitoring has found no evidence the stolen information has been shared or published. No extortion group has claimed the data.
Why It Matters
The victim population is uniquely exploitable. Heights lends to people with constrained credit access. That demographic is disproportionately targeted by advance-fee loan scams and debt-relief fraud, and is the least equipped to absorb a drained bank account or spend months disputing a synthetic identity. Any actor holding this dataset already knows each victim needed money, roughly how much, and which bank it flows through.
The three-month notification gap is the operational story. Discovery on May 7, public notice on August 11. Emery Reddy highlights the delay directly. Whatever the legal defensibility, the practical effect is that if this data reached criminal hands in May, victims had a full quarter of unmonitored exposure before anyone told them to freeze credit or watch their accounts.
"Not our systems" is a narrower claim than it reads. Heights repeatedly and accurately stresses that loan management systems were untouched. That is a meaningful containment fact for the company's operational integrity. It is close to irrelevant to the victims, whose SSNs and routing numbers were taken regardless of whose infrastructure held them. Third-party cloud data stores continue to be the softest edge of otherwise well-defended financial services organizations.
Consolidation inherits liability. The inclusion of Curo Management legacy borrowers shows historical customer records surviving corporate restructuring and landing in a modern cloud repository. Data acquired through M&A rarely gets the retention scrutiny of live production data, and it expands the blast radius to people who ended their relationship with the lender years ago.
The Attack Technique
Heights has not disclosed an initial access vector, and no source in this reporting set supplies one. What the primary statements establish is limited:
- Access was to a third-party hosted cloud platform used for customer data storage, not to internal loan management systems or corporate networks.
- The actor "may have viewed or copied" data, which is the standard phrasing used when exfiltration is inferred from access logs rather than directly observed.
- The intrusion was discovered on May 7, 2026; the notice does not state a dwell time or an initial compromise date, so the exposure window's start is unknown.
- No threat actor has been named. SecurityWeek states it has seen no claim of the attack, and no ransomware or extortion leak site listing has been reported.
The unstated details matter. Whether this was a stolen credential against a SaaS tenant, an exposed storage bucket, an OAuth token abuse, or a compromise of the hosting provider itself remains unknown. Given the 2024 to 2026 pattern of mass credential-driven raids on cloud data warehouses affecting dozens of downstream tenants, that ambiguity is worth flagging: nothing here confirms such a campaign, but nothing rules it out either, and the third-party host has not been named by any source.
What Organizations Should Do
- Inventory every third-party platform holding regulated customer data, and name an owner for each. The gap this incident exposes is not detection on internal networks. It is that customer PII often lives in vendor-hosted environments with unclear telemetry ownership. Produce the list, map what data class sits in each, and confirm who reviews the logs.
- Demand and centralize vendor-side authentication and access logs. If a cloud data store's audit trail lives only in the vendor's console, your SOC cannot alert on it. Pull SaaS and cloud tenant logs into your SIEM and build detections for anomalous bulk export, first-seen geolocations, and service-account access outside business hours.
- Enforce phishing-resistant MFA and eliminate standing credentials on data stores. Mass cloud-tenant compromises overwhelmingly trace back to a credential without hardware-backed MFA. Apply IP allowlisting or network policy on data warehouse tenants, rotate long-lived tokens, and audit every service account with bulk read access.
- Cut retention on acquired and legacy records. The Curo Management exposure is the lesson: data from prior corporate entities was still queryable years later. Run a purge cycle against inactive applicants and closed accounts, and treat post-M&A data migration as a mandatory retention review, not a lift-and-shift.
- Pre-write and pre-test the notification path. Three months from discovery to notice is a reputational and regulatory liability multiplier. Have counsel-approved templates, state AG filing procedures and a monitoring vendor contracted before an incident, so scoping is the only thing on the critical path.
- For affected individuals, act on the full identity kit, not just credit. Freeze credit at all three bureaus, request an IRS Identity Protection PIN given that tax IDs were exposed, and contact your bank about ACH-level protections because routing and account numbers were in scope. Heights is offering 24 months of free credit monitoring and identity protection, which is worth enrolling in but does not cover bank-level fraud or the free-text personal details that were also taken.
Sources: Heights Finance Data Breach Impacts at Least 1.2 Million Individual... | Nearly 750k had financial info, SSNs leaked in South Carolina loan... | Hackers Expose Data of 1.2 Million Heights Finance ... | Notice of Data Breach | Heights Finance Holdings Co. Encourages Individuals to Take Precaut... | Heights Finance data breach: What customers need to know | Heights Finance Data Breach | Personal Loans Online & In-Branch Heights Finance