Heights Finance data breach: who is affected and what you should do now

On May 7, 2026, Heights Finance Holdings found that an unauthorized person had accessed a third-party cloud platform used to store certain customer data. The company says that activity did not reach Heights’ own loan-management systems. It published its official notice on August 11, 2026.

Those records may have included names, addresses, phone numbers, email addresses, bank names, account and routing numbers, Social Security numbers, tax IDs, driver’s licenses or state IDs, dates of birth, and personal details shared in customer-service conversations. The notice covers Heights borrowers, people who only inquired or applied — including through a third party — and former borrowers of Curo Management or its related brands. Attorney-general filings list 734,828 people in Texas, 486,463 in South Carolina, 21 in Vermont, and 26 in New Hampshire, more than 1.2 million from those four states alone. Heights has not published a nationwide total. It offered 24 months of free credit monitoring and said it had not found the data posted on the dark web as of the notice date.

The sentence that sounds like good news, and isn’t

Almost every account of this incident leads with the same two points: the break-in was limited to a third-party cloud platform, not Heights’ own systems, and nothing had shown up for sale as of mid-August. Both statements come from the company, and neither one is false. They are also not the part that changes anything for you.

What may have been viewed or copied is a file of real people at real home addresses, with Social Security numbers, bank account and routing numbers, and government ID numbers — plus whatever they told a loan agent about their situation. That is not a leaked password. It is the set of facts someone needs to open credit, impersonate you with a bank or the IRS, or make a fake “we need to verify your loan” call sound true. Heights’ wording is that an unauthorized person may have viewed or copied the records. That is not a finding that the data stayed put. It is a finding that the company cannot prove it did.

There is a second mismatch between the headlines and the people involved. This notice is not limited to current Heights customers. It covers anyone who asked about or applied for a loan, and former borrowers of Curo Management or brands related to it. If you filled out a form and walked away, or you paid off a loan years ago under a name that was not Heights Finance, you can still be in this file. The 1.2 million figure is only the four states whose filings have been cited in public. Heights never published a nationwide count, so that number is a floor, not a total.

What to actually expect

• If you are in the group Heights described, expect a mailed notice and an offer of 24 months of free credit monitoring and identity protection. That letter is how the company is telling people. There is no reliable public website that can look up whether a given person was in this incident.
• The near-term money risk is someone using a bank account and routing number that Heights or a related brand already had on file. Watch those specific accounts for withdrawals, new payees, or transfers you did not authorize.
• Because Social Security numbers, dates of birth, and driver’s license or state ID numbers were in the same records, also watch for credit applications you did not make and for tax filings or tax-agency letters you were not expecting. Those usually arrive as a credit alert, a rejected tax return, or a bill for a debt you do not recognize.
• Treat unexpected calls or emails about a Heights, Curo, or old loan-brand account as hostile until you have checked them through a number or site you already trust. The stolen file can include personal details people shared when they were asking for help, which is what makes a fake verification call convincing.

What you can and cannot fix

What cannot be undone: if your name, home address, Social Security number, tax ID, driver’s license or state ID number, date of birth, or bank account details were in that cloud platform, those facts are out. They cannot be recalled, deleted from the other copy, or made secret again. Twenty-four months of monitoring does not expire a Social Security number. A national ID number that is out, is out.

• Freeze your credit at Equifax, Experian, and TransUnion. A freeze is the step that actually blocks most new-account fraud that uses a stolen Social Security number and date of birth. It is free, and you can lift it when you need credit. That matters more here than monitoring alone, because monitoring tells you after someone has already applied.
• On any checking or savings account whose number you ever gave Heights, Curo, or a related brand, watch the transactions and ask the bank about alerts or, if you are uneasy, a new account number. Routing and account numbers in this kind of file are used for unauthorized withdrawals, not just new credit cards.
• If Heights’ offer arrives, enroll in the 24 months of credit monitoring and identity protection. It will not pull the data back, but it is the one channel the company is paying for, and it can flag new-credit activity you would otherwise miss.
• Cut back what people-search sites publish about you. A leaked record of your name, address, and Social Security number becomes much more useful to a stranger when it can be joined to listings that add relatives, phone numbers, employers, and previous addresses. Those listings, unlike the breached file, can actually be removed. That is the part of your footprint you can still shrink.