Heights Finance Data Breach Exposes Financial and Personal Information of Nearly 750,000 Customers

Data Breach at Heights Finance

Heights Finance, a debt consolidation loan company, announced a data breach that compromised the personal and financial information of nearly 750,000 customers. The incident, discovered on May 7, involved unauthorized access to a cloud-based platform hosted by a third party, which the company used to store customer data. The company confirmed that its internal loan management systems and other computer networks were not affected.

Compromised Customer Information

The stolen data includes a range of sensitive information such as contact details (addresses), banking data (account and routing numbers), and government identification numbers (Social Security numbers, tax IDs, driver’s license numbers, or state IDs). Any personal information shared during customer service interactions was also exposed. The breach impacts individuals who received a loan or inquired about a loan product through Heights Finance or its parent company, Curo Management, and related brands.

Company Response and Monitoring

Heights Finance has stated that the compromised cloud platform has been secured and there is no ongoing security threat. The company has engaged a cybersecurity firm to monitor the dark web for any evidence of the stolen information. As of the latest update, no evidence of the data appearing on dark web forums or marketplaces has been found. No specific hacking group has claimed responsibility for the breach.

Impact and Background

This breach underscores the vulnerabilities associated with third-party cloud services, even for companies with established security protocols. Heights Finance operates over 285 offices across 11 states, primarily in the southeastern U.S. The company has faced scrutiny in the past, including a federal lawsuit regarding its lending practices, which was later dismissed.