{"id":"heights-finance-customer-data-breach-aug-2026","category":"breach","status":"closed","title":"Heights Finance breach potentially exposes identity and bank data of 4.1 million people","tldr":"A Heights Finance cloud-platform breach affected 4,132,834 people, potentially exposing identity and banking details. Borrowers, applicants and some former Curo borrowers may be affected. Ask Heights about its free identity protection and check bank activity.","summary":"Heights Finance disclosed unauthorised access to a third-party cloud platform used to store customer information. Indiana’s regulatory record dates the breach to 13 March 2026 and reports 4,132,834 people affected; Heights discovered it on 7 May. People potentially affected include borrowers, people who enquired about or applied for loans, including through third parties, and former borrowers of Curo Management or related brands. Depending on the person, information potentially viewed or copied included contact details, bank account and routing numbers, Social Security numbers, other government identifiers and dates of birth. In its 11 August notice, Heights said the investigation was complete, the platform was secure and its loan management systems were unaffected. It offered free Epiq credit monitoring and identity protection. Heights reported no evidence of the information appearing on the dark web at that time; subsequent misuse remains unknown. Eleven lawsuits were consolidated on 1 October. No settlement or criminal charges were identified in the sources reviewed through 3 November.","action":"If you borrowed from Heights or Curo, or applied for or enquired about a Heights loan, ask Heights whether your information was involved and how to enrol in its free Epiq protection. Check bank activity and promptly report unfamiliar transactions to your bank.","product":"Heights Finance customer and loan applicant information","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["heights-finance","data-breach","financial-data","identity-theft","cloud"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Heights Finance Notice of Data Breach","url":"https://www.classaction.org/media/heights-finance-data-breach-web-notice-2026.pdf","by":"Heights Finance","date":"2026-08-11"},{"kind":"advisory","title":"October 2026 year-to-date data breach report","url":"https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-October-Year-to-Date-Report-2026.pdf","by":"Indiana Attorney General","date":"2026-10-01"},{"kind":"news","title":"Heights Finance Data Breach","url":"https://www.classaction.org/data-breach-lawsuits/heights-finance-august-2026","by":"ClassAction.org","date":"2026-08-21"},{"kind":"research","title":"Data breaches in August 2026","url":"https://www.serus.ai/data-breaches/report/2026-08/","by":"Serus","date":"2026-10-18"},{"kind":"post","title":"Hoylman-Capecchi v. Heights Finance Holding Co","url":"https://dockets.justia.com/docket/south-carolina/scdce/6:2026cv03564/323514","by":"Justia","date":"2026-08-19"},{"kind":"post","title":"Waitkus v Heights Finance Holding Co — docket and consolidation order","url":"https://dockets.justia.com/docket/south-carolina/scdce/6:2026cv03672/323763","by":"Justia","date":"2026-10-01"}],"started":"2026-08-11","closed":"2026-10-01","created":"2026-11-03T20:27:25.786Z","updated":"2026-11-03T20:27:25.786Z","cve_notes":[],"timeline":[{"at":"2026-10-01","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"The court consolidated 11 breach lawsuits into Nash v. Heights Finance Holding Company and appointed interim lead lawyers. It ordered a consolidated complaint within 45 days.","url":"https://dockets.justia.com/docket/south-carolina/scdce/6:2026cv03672/323763","by":"Justia","patch":null},{"at":"2026-08-19","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Debbie Hoylman-Capecchi filed a proposed class action against Heights Finance in the US District Court for South Carolina.","url":"https://dockets.justia.com/docket/south-carolina/scdce/6:2026cv03564/323514","by":"Justia","patch":null},{"at":"2026-08-14","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Serus’s later review of regulatory notices records Heights’ Texas filing on this date, with 4,132,834 people affected overall.","url":"https://www.serus.ai/data-breaches/report/2026-08/","by":"Serus","patch":null},{"at":"2026-08-11","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"Heights issued its public notice, saying information may have been viewed or copied. It said its investigation was complete, the platform was secure and free Epiq credit monitoring and identity protection were available.","url":"https://www.classaction.org/media/heights-finance-data-breach-web-notice-2026.pdf","by":"Heights Finance","patch":null},{"at":"2026-05-07","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Heights discovered unauthorised access to a third-party cloud platform holding customer data. It brought in cybersecurity specialists and notified federal law enforcement.","url":"https://www.classaction.org/media/heights-finance-data-breach-web-notice-2026.pdf","by":"Heights Finance","patch":null},{"at":"2026-03-13","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Indiana’s regulator lists this as the breach date. Its record reports 4,132,834 people affected overall, including 182,731 Indiana residents.","url":"https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-October-Year-to-Date-Report-2026.pdf","by":"Indiana Attorney General","patch":"na"}],"url":"https://hard.fyi/live/heights-finance-customer-data-breach-aug-2026/","json":"https://hard.fyi/api/live?id=heights-finance-customer-data-breach-aug-2026"}