Heights Finance Holdings Co., a consumer lending company, has disclosed a significant data breach impacting the personal and financial information of more than 1.2 million individuals. The breach occurred in early May when hackers infiltrated a third-party cloud-based platform used by Heights for storing customer data. Although Heights Finance has assured the public that its main operations and loan management systems remain uncompromised, the breach has led to the unauthorized access and theft of sensitive data, including names, addresses, phone numbers, Social Security numbers, and bank account information.
The breach affects not only current customers but also individuals who have previously inquired about, applied for, or received loans through Heights Finance or its associated brands, including those previously managed by Curo Management. Notifications sent to several state Attorney Generals' Offices confirm the scale of the breach, with Texas and South Carolina being the most affected.
In response to the breach, Heights Finance has activated its incident response protocols, engaged external cybersecurity experts, and reported the incident to federal law enforcement. The company is offering 24 months of free credit monitoring and identity protection services to those affected. Despite extensive monitoring, there is currently no evidence that the compromised data has been disseminated on the dark web. As of now, the identity of the hackers remains unknown, with no group claiming responsibility for the attack.