Cyber Incident Victim: Heights Finance Holdings Co.
Timeline
Summary
Heights Finance Holdings Co. discovered that an unauthorized actor gained access to a third‑party cloud platform used to store certain customer data. The exposed information may include names, addresses, phone numbers, email addresses, account details, bank account information, Social Security numbers, tax identification numbers, driver’s license numbers, state identification numbers, and dates of birth. Individuals who obtained a loan, inquired about or applied for a loan product, or were former borrowers of Curo Management or its related brands may be affected. The company stated the breach was limited to the cloud platform and did not impact its loan management or other systems. Edelson Lechtzin LLP has launched an investigation into potential data‑privacy claims and is offering free case evaluations. The company is providing 24 months of complimentary credit monitoring and identity protection services through a third party.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or about May 7, 2026, Heights Finance Holdings Co. discovered that an unauthorized actor had gained access to a cloud-based platform hosted by a third party that the company used to store certain customer data. The unauthorized activity was confined to that cloud-based platform and did not extend to Heights Finance’s loan management systems or other computer systems or networks. According to the company’s statement, the breach may have compromised sensitive personal and financial information, including names, addresses, phone numbers, email addresses, account details, bank account information (such as bank name, account number, and routing number), Social Security numbers, tax identification numbers, driver’s license numbers, state identification numbers, and dates of birth. Individuals who may be affected include those who received a loan through Heights Finance, inquired about or applied for a loan product (including through a third party), or were former borrowers of Curo Management or any of its former or current related brands. Those who received a data breach notification from Heights Finance may face an increased risk of identity theft and fraud.
In response to the incident, Edelson Lechtzin LLP, a national class action law firm, announced that it is investigating data privacy claims arising from the Heights Finance data breach and is offering free case evaluations to individuals whose personal information may have been compromised. The firm is evaluating the potential for a class action to pursue legal remedies on behalf of affected individuals. Heights Finance is providing 24 months of complimentary credit monitoring and identity protection services through Epiq (Privacy Solutions ID) to eligible individuals, with enrollment available before the November 9, 2026 deadline. The company has also indicated that it is notifying individuals whose information may have been involved in the breach. The combination of the unauthorized access, the scope of the exposed data, and the subsequent notifications underscores the impact of the incident on the affected consumer base.