A massive data breach affecting over 1.2 million individuals has come to light, with consumer lender Heights Finance Holdings Co. notifying those whose personal and financial information was stolen by hackers. The incident, which occurred in early May, involved a third-party cloud-based platform used for customer data storage that was accessed by the attackers.
The breach is significant, not just due to its scale but also because of the sensitive nature of the data compromised. Heights Finance reported that hackers stole personal and financial information, including names, addresses, email addresses, phone numbers, Social Security numbers, government ID numbers, driver’s license numbers, bank account information, account details, dates of birth, and other information customers shared with the company.
The breach is thought to have been limited to a third-party cloud-based platform used by Heights Finance for customer data storage. The lender emphasized that its loan management systems and other computer systems or networks were not affected by the incident. Following discovery, Heights activated its incident response protocols and brought in outside cybersecurity specialists to investigate. The company also notified federal law enforcement.
The 1.2 million individuals affected by the breach include those who received a loan through Heights, inquired about or applied for a loan product, or were former borrowers of Curo Management or any of its related brands. To mitigate potential harm, Heights is offering affected individuals 24 months of free credit monitoring and identity protection services.
A key aspect of this incident is that there is currently no evidence suggesting the stolen data has been shared on the dark web by the hackers. This raises questions about the motivations behind the breach and whether it may be a prelude to future attacks or simply an attempt to collect sensitive information for later use.
For those who have had their personal and financial information compromised, this incident serves as a stark reminder of the importance of vigilance in protecting sensitive data. As we continue to rely on digital systems for various aspects of our lives, it is essential that we stay informed about potential security risks and take steps to safeguard our online presence.
In light of this breach, individuals are advised to remain vigilant and regularly monitor their financial accounts for any suspicious activity. They should also consider taking proactive measures such as setting up two-factor authentication and keeping software and operating systems up-to-date with the latest security patches. By being informed and taking steps to protect themselves, individuals can minimize potential harm in the event of a data breach.
Source: SecurityWeek — 2026-08-18