Heights Finance breach may expose Social Security and bank data for loan customers

Heights Finance Holdings told customers that an unauthorized party accessed a third-party cloud platform used to store loan-related information, according to the company breach notice and Malwarebytes reporting on Aug. 18.

The firm discovered the intrusion on May 7. Investigators found the intruder may have viewed or copied data in that cloud environment. A Texas regulatory filing cited by The Record and summarized by Malwarebytes mentioned 734,828 affected people. That figure should not be treated as a final nationwide total because Heights operates personal loan companies across several states, including Alabama, Tennessee, Georgia, Texas, and South Carolina.

People who may be affected include Heights Finance borrowers, people who inquired about or applied for loans, and some customers tied to former parent company CURO Management and related brands.

Data that may have been exposed includes names, addresses, phone numbers, emails, bank names, account and routing numbers, Social Security numbers, tax IDs, driver licenses or state IDs, dates of birth, and personal details shared in customer service talks. That mix is useful to identity thieves and phishing crews.

Heights Finance posted instructions and protection enrollment details on its website. People who get a letter should follow those steps. Anyone who thinks they may be included but has no letter should use contact methods published on the official site, not a number from an unexpected text, email, or search ad.

After a breach like this, criminals often send fake help desk calls or refund offers. Hang up on surprise callers. Monitor bank and credit accounts. Consider a credit freeze with the major bureaus if your Social Security number may be involved.