Heights Finance breach potentially exposes identity and bank data of 4.1 million people
A Heights Finance cloud-platform breach affected 4,132,834 people, potentially exposing identity and banking details. Borrowers, applicants and some former Curo borrowers may be affected. Ask Heights about its free identity protection and check bank activity.
If you borrowed from Heights or Curo, or applied for or enquired about a Heights loan, ask Heights whether your information was involved and how to enrol in its free Epiq protection. Check bank activity and promptly report unfamiliar transactions to your bank.
What’s happening
Heights Finance disclosed unauthorised access to a third-party cloud platform used to store customer information. Indiana’s regulatory record dates the breach to 13 March 2026 and reports 4,132,834 people affected; Heights discovered it on 7 May. People potentially affected include borrowers, people who enquired about or applied for loans, including through third parties, and former borrowers of Curo Management or related brands. Depending on the person, information potentially viewed or copied included contact details, bank account and routing numbers, Social Security numbers, other government identifiers and dates of birth. In its 11 August notice, Heights said the investigation was complete, the platform was secure and its loan management systems were unaffected. It offered free Epiq credit monitoring and identity protection. Heights reported no evidence of the information appearing on the dark web at that time; subsequent misuse remains unknown. Eleven lawsuits were consolidated on 1 October. No settlement or criminal charges were identified in the sources reviewed through 3 November.
- What
- Breach
- Affects
- Heights Finance customer and loan applicant information
- Fixed in
- Nothing to patch
- Since
- 11 Aug 2026
- Closed
- 1 Oct 2026
Timeline
- Update
The court consolidated 11 breach lawsuits into Nash v. Heights Finance Holding Company and appointed interim lead lawyers. It ordered a consolidated complaint within 45 days.
- Update
Debbie Hoylman-Capecchi filed a proposed class action against Heights Finance in the US District Court for South Carolina.
- Update
Serus’s later review of regulatory notices records Heights’ Texas filing on this date, with 4,132,834 people affected overall.
- Made public
Heights issued its public notice, saying information may have been viewed or copied. It said its investigation was complete, the platform was secure and free Epiq credit monitoring and identity protection were available.
- Update
Heights discovered unauthorised access to a third-party cloud platform holding customer data. It brought in cybersecurity specialists and notified federal law enforcement.
- UpdateNothing to patch
Indiana’s regulator lists this as the breach date. Its record reports 4,132,834 people affected overall, including 182,731 Indiana residents.
Sources
- Heights Finance Notice of Data BreachHeights Finance · 11 Aug 2026
- October 2026 year-to-date data breach reportIndiana Attorney General · 1 Oct 2026
- Heights Finance Data BreachClassAction.org · 21 Aug 2026
- Data breaches in August 2026Serus · 18 Oct 2026
- Hoylman-Capecchi v. Heights Finance Holding CoJustia · 19 Aug 2026
- Waitkus v Heights Finance Holding Co — docket and consolidation orderJustia · 1 Oct 2026