Heights Finance Data Breach

Heights Finance discovered in May that hackers had accessed a cloud platform holding borrower data. It didn’t tell people until August, more than three months later, by which point at least 734,828 Texans alone were confirmed affected.

Heights Finance Holdings Co., a consumer lender that also operates under the Covington Credit, Quick Credit, and Southern Finance brands, posted a Notice of Data Breach on August 11, 2026. Heights says it discovered on May 7, 2026 that an unauthorized actor had gained access to a cloud-based platform hosted by a third party that the company uses to store certain customer data. Heights states the activity was limited to that cloud platform and did not affect its loan management systems.

A filing with the Texas Attorney General, published August 14, 2026, confirms 734,828 Texas residents affected, the largest single-state figure of any breach in this batch. Heights has not disclosed a nationwide total; a separate filing with the Vermont Attorney General reported only 21 Vermont residents, suggesting the affected population is concentrated in the company’s Southern and Midwestern lending footprint.

96 Days Between Discovery and Notice

Heights Finance discovered the incident on May 7, 2026. It did not post notice or file with regulators until August 11, 2026, a gap of 96 days. Heights’ notice does not explain the reason for the delay.

You Don’t Have to Be a Current Customer to Be Affected

Heights Finance’s notice states that a person’s information may be involved if they received a loan through Heights, or if they simply inquired about or applied for a loan product, including through a third party. It also covers former borrowers of Curo Management or any of its former or current related brands. In other words, someone who applied and was turned down, or who has not borrowed from Heights in years, could still be in the affected group.

What Information Was Exposed?

According to Heights Finance’s notice, the information involved may include:

• Full name, address, phone number, or email address
• Account details, bank name, bank account number, and routing number
• Social Security number, tax ID number, driver’s license number, or state ID number
• Date of birth
• Personal circumstances voluntarily shared during customer service interactions

The specific information involved varies by individual.

How Many People Are Affected?

At least 734,828 Texas residents, according to the Texas Attorney General’s published filing. Heights Finance has not disclosed a nationwide total, so the true number of affected individuals across all states is likely higher.

What Is Heights Finance Offering Affected Individuals?

Heights Finance is offering free credit monitoring and identity protection services through a third-party provider, Epiq, for 24 months at no cost. The deadline to enroll is November 9, 2026. Affected individuals need an Activation Code from their letter, or can call Epiq at 866-675-2006, Monday through Friday, 9 a.m. to 9 p.m. Eastern, to receive one.

Your Information Is at Risk

This is one of the more complete financial-data exposures in recent memory: Social Security numbers, tax ID numbers, driver’s license or state ID numbers, dates of birth, and full bank account information including routing numbers. That combination is enough to open new credit, file a fraudulent tax return, or attempt to redirect funds directly out of a bank account. The free-text customer service notes some borrowers shared, describing their personal financial circumstances, add another layer of exposure most breaches don’t involve. Affected individuals should watch bank and credit accounts closely, consider a credit freeze, and enroll in the credit monitoring Heights is offering before the November 9 deadline.

Do You Have Legal Options?

Consumer lenders that collect Social Security numbers, government ID numbers, and bank account information have a legal duty to secure that data and to notify affected individuals without unreasonable delay.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review if you received a notice letter from Heights Finance.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

FAQ

Who is affected by the Heights Finance data breach?

Current and former Heights Finance, Covington Credit, Quick Credit, and Southern Finance customers, anyone who applied for or inquired about a loan (including through a third party), and former borrowers of Curo Management or its related brands. At least 734,828 Texas residents are confirmed affected.

What information was exposed?

Name, address, phone number, email address, Social Security number, tax ID number, driver’s license or state ID number, date of birth, bank account information including routing numbers, and, for some individuals, notes describing personal circumstances shared with customer service, per Heights Finance’s own notice.

Why did it take 96 days to be notified?

Heights Finance discovered the incident on May 7, 2026, but did not post notice or file with regulators until August 11, 2026. The company’s notice does not explain the delay.

I never took out a loan with Heights Finance. Could I still be affected?

Possibly. Heights Finance’s notice states that people who merely inquired about or applied for a loan, including through a third party, may be affected, as may former borrowers of Curo Management or its related brands.

Is Heights Finance offering credit monitoring?

Yes. Heights Finance is offering 24 months of free credit monitoring and identity protection through Epiq. The enrollment deadline is November 9, 2026.

Do I have a legal claim?

Consumer lenders that collect Social Security numbers, government ID numbers, and bank account information have a legal duty to secure that data and to notify affected individuals without unreasonable delay. If you received a notice from Heights Finance, or applied for a loan through Heights, Covington Credit, Quick Credit, Southern Finance, or Curo Management, contact the Data Breach Attorneys at Emery | Reddy at 206.207.8929 or www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.