Heights Finance data breach: loan customers' bank and ID details on a third-party cloud platform

What happened in the Heights Finance breach?

Heights says the activity was limited to the cloud platform and did not reach its loan management systems or its other computer systems or networks. It says it brought in outside cybersecurity specialists and reported the incident to federal law enforcement, and that its investigation is complete. The letter says the actor may have viewed or copied information on the platform. It does not name the platform's provider or say how the actor got in.

Date	What the letter and the regulators' records say
March 13, 2026	Breach begins, on the Texas and Indiana records
May 7, 2026	Heights discovers the access
August 11, 2026	Indiana's report gives this as the date notice was sent
August 14, 2026	Posted on the Texas attorney general's list
August 19, 2026	Reported to Massachusetts (62 residents)

55 days passed between the breach date on the Indiana and Texas records and the discovery, and notice went out 96 days after the discovery. The guide to notice delays sets that gap beside the rest of the log.

Why did I get a letter from Heights Finance?

The letter names three groups: people who received a loan through Heights, people who asked about or applied for a loan product (including through a third party), and former borrowers of Curo Management or its former or current brands. So an applicant who never took a Heights loan, or a borrower who dealt only with another brand, can still get one. The guide to letters from companies you never dealt with explains how that happens.

What information was involved?

Group in the letter	Items
Contact details	Name, address, phone number or email address
Financial information	Account details, bank account information (bank name, account number and routing number) or related financial data
Government identifiers	Social Security number, tax ID, driver's license number or state ID number
Additional information	Date of birth, or information a consumer volunteered, such as personal circumstances shared with customer service

Massachusetts' record marks Social Security numbers, financial accounts, driver's licenses and credit or debit card numbers as breached, and medical records as not breached. Texas lists names, addresses, Social Security numbers, driver's license numbers, government-issued ID numbers, financial information and dates of birth.

How many people were affected?

Regulator	What it counts	Number
Indiana attorney general	Total affected	4,132,834
Texas attorney general	Texans	734,828
Indiana attorney general	Indiana residents	182,731
Massachusetts consumer affairs office	Massachusetts residents	62

Its 182,731 Indiana residents make it the fourth largest of the 1,361 notices sent in 2026 in Indiana's report (Indiana ranking).

Texas ranks it tenth by Texans affected in the Texas ranking. The letter gives no count, and its Rhode Island section says the number of Rhode Island residents was not known when it was written.

What is Heights Finance offering?

Heights says it pays for 24 months of credit monitoring and identity protection from Epiq (Privacy Solutions ID) for people who believe their information was involved. The service includes single-bureau credit monitoring, dark web monitoring, help with freezes at all three bureaus, change-of-address monitoring and identity restoration. Heights also says a specialist is scanning the dark web for the data and had found none when the letter was written.

Item	Detail from the letter
Provider	Epiq, Privacy Solutions ID
Length	24 months, paid by Heights
Enrollment	www.privacysolutionsid.com, with the activation code in the notice
Deadline	Printed on each notice (a blank field in the filed copy)
Epiq help	866-675-2006, Monday to Friday, 9:00 a.m. to 5:30 p.m. ET
Heights call center	877-343-7785, Monday to Friday, 9:00 a.m. to 9:00 p.m. ET
Limits	Epiq's service may not be available without established credit, a U.S. address or a valid Social Security number

Is the Heights Finance notice email real?

The copy filed in South Carolina is an email from "Heights Notification" at the address noreply@heightsnotification.com, with the subject line Notice of Data Breach. It points readers to heightsfinance.com/ImportantInfo for more. The enrollment site it names is privacysolutionsid.com.

What the documents leave open

• Which third party hosts the cloud platform, and how the actor got in.
• Whether the data was copied, or only viewed.
• How the 4,132,834 people divide between borrowers, applicants and former Curo Management borrowers.

For how other lenders' letters compare, see the guide to bank, brokerage and mortgage breach notices.