Heights Finance Discloses Data Breach Affecting Up to 1.2 Million People

Heights Finance Holdings is notifying more than 730,000 customers of a significant data security incident after an unauthorised threat actor gained access to a third-party system used by the company to store customer data. 

 

Headquartered in Greenville, South Carolina, Heights Finance Holdings is a U.S.-based consumer finance company specialising in secured and unsecured personal instalment loans. The company operates hundreds of branches across several states and manages multiple lending brands, including Heights Finance, Covington Credit, Quick Credit, and Southern Finance.

 

In a data security incident notice filed with the Office of Attorney General of New Hampshire, Heights Finance said that on May 7, an unauthorised actor gained access to a third-party cloud-based platform used to store certain customer data. The finance company immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

It also took steps to contain the incident, secure the affected network and notified relevant law enforcement authorities about the same.

 

“The investigation determined an unauthorised actor may have viewed or copied certain information from the cloud-based platform between March 13 to May 7, 2026,” Heights Finance said.

 

The compromsied data inlcuded names, addresses, phone numbers, email addresses, account details, bank account information including bank names, account numbers, and routing numbers, Social Security numbers, tax ID, driver’s license numbers, and other state ID numbers. 

 

While a Texas state regulator filing states that Heights Finance identified at least 734,828 people impacted by the incident, reports on Reddit claim the breach may have affected at least 1.2 million individuals. The discrepancy suggests that the full scope of the incident may be larger than the figure disclosed in the regulatory filing, although the 1.2 million figure remains unverified.

 

“Importantly, this activity was limited to that cloud-based platform only—it did not affect any of Heights’ loan management systems or other computer systems or networks,” the company added.

 

Heights Finance has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

It has also offered complimentary identity protection and credit monitoring services through Epiq to all affected individuals.

 

At the time of publishing, no known hacker group claimed responsibility for the cyber attack on Heights Finance. The finance company also did not share details on who was behind the attack, how much data was compromised, or whether it had received a ransom demand.