Heights Finance Breach Exposes Financial Data and Social Security Numbers of 734,828 People

Intrusion Targeted a Third-Party Cloud Platform

Heights Finance suffered a data breach that may have exposed the personal and financial information of 734,828 people. Based in Greenville, South Carolina, the company provides personal loans and debt-consolidation services.

The intrusion was detected on May 7, when an attacker gained access to a cloud platform operated by an external provider. The system stored some customer data belonging to Heights Finance.

The company notified customers of the incident last week and reported it to Texas authorities on Friday. Initial estimates involved approximately 750,000 people, while the subsequent figure identified 734,828 affected individuals.

The incident affects people who received a loan from Heights Finance or requested information about a financial product through a third party. It also includes some customers of Curo Management, Heights Finance’s parent company, and its affiliated brands.

What Information May Have Been Stolen

The exposed data was not limited to contact information. According to the company’s notice, the information potentially accessible through the compromised platform may include:

• names and addresses;
• bank account numbers;
• bank routing numbers;
• Social Security numbers;
• tax identification numbers;
• driver’s license numbers;
• state-issued identification numbers;
• other personal information provided to customer service.

It is not known whether every affected individual had all of these data elements exposed. The list describes the categories of data stored on the compromised platform but does not clarify which information was actually accessed or copied for each person.

However, the combination of government-issued identifiers and banking information increases the potential severity of the incident. Criminals could attempt to open accounts or apply for credit using victims’ identities, commit banking fraud, or create highly convincing phishing campaigns.

Even seemingly less sensitive data, such as addresses and information provided to customer service, can help an attacker personalize communications. A message referencing a legitimate loan or financing inquiry may appear more credible than a generic scam.

Access Was Reportedly Contained to the Cloud Environment

Heights Finance says the malicious activity was limited to the affected cloud platform. The company’s loan-management systems, other IT systems, and corporate networks were not reportedly compromised.

The company also says it secured the platform and found no evidence of an ongoing threat. It has not disclosed the cloud provider’s name, the initial attack vector, how long the access lasted, or who was responsible.

Without that information, it is impossible to reconstruct the breach’s technical details with precision. It remains unclear whether the access resulted from stolen credentials, a misconfiguration, a service vulnerability, or an attack aimed directly at the provider.

The reported lack of impact on loan-management systems limits at least one of the most serious scenarios: no changes to contracts, applications, or loan-origination processes have been reported. The theft of data stored in the cloud nevertheless creates concrete risks for affected individuals.

An Extensive Presence Across Multiple States

Heights Finance operates dozens of companies specializing in personal loans in Alabama, Tennessee, Georgia, Texas, and South Carolina. Its network includes more than 285 offices across 11 states.

The company’s broad footprint helps explain the number of people affected. The population involved does not necessarily consist only of customers with active loans; the breach may also affect people who requested information about financing products through third-party channels.

Responsibility has not been publicly attributed to a specific criminal group. Heights Finance hired a cybersecurity firm to search the dark web for any related data, including forums, marketplaces, and other platforms used to trade stolen information.

At the time of the announcement, the monitoring activity had found no evidence that the data had been published or offered for sale. The absence of public evidence does not prove that the information is unusable or that it will not appear later. Stolen data can be held for long periods before being exploited or sold.

What Affected Individuals Should Monitor

Anyone who received a notice from Heights Finance should closely review activity on their bank accounts and payment cards, paying particular attention to small, unrecognized charges. Fraudsters may initially use small amounts to test whether an account is active.

People should also be wary of phone calls, text messages, and emails referencing loans, refinancing, or requests for documents. No verification code, password, or full account number should be provided in response to an unexpected message.

Individuals whose Social Security numbers, tax identification numbers, or identity documents may have been involved should consider available identity-theft protection measures and monitor more frequently for unauthorized credit applications. If suspicious activity appears, they should contact the financial institution directly using verified contact details—not information included in the received communication.

Heights Finance identified four primary actions: securing the cloud platform, conducting checks for any persistent threat, monitoring the dark web, and notifying customers and Texas authorities.

The company has not announced additional details about free identity-theft protection services, document replacement, or reimbursement for victims’ expenses. It is also unknown whether there is evidence that the stolen information has been used fraudulently.

The Company’s Prior Legal History

The breach comes amid an already controversial history for Heights Finance. The company had been sued by the federal government over practices involving financially distressed borrowers seeking to refinance existing loans.

According to federal prosecutors, the business model generated revenue through fees charged for repeated refinancing. The case was dismissed shortly after the Trump administration took office.

That legal action does not establish a connection to the cybersecurity incident, nor does it indicate that the data was stolen for the purposes alleged in the case. It does, however, provide context for assessing the sensitivity of the information held by the company: the data also relates to people who sought credit or financial restructuring while potentially in vulnerable circumstances.

For now, the reported technical scope remains limited to the third-party cloud platform. The number of affected individuals and the nature of the exposed identifiers nevertheless make the breach a significant risk for banking fraud, identity theft, and targeted phishing.