Contained Medium impact Data breach Checked 2d ago

Heights Finance breach exposes 1.2 million customers

Heights Finance, a US consumer lender, says hackers broke into a third-party cloud platform that stored customer data and stole names, addresses, phone numbers, Social Security numbers and financial details. More than 1.2 million people are being notified, with the largest group in Texas and others in Alabama, Tennessee, Georgia and South Carolina. The company says it is working with outside cybersecurity experts and has told federal law enforcement.

Started
May 7, 2026
Latest activity
Sep 1, 2026
Attributed to
Not confirmedNo credible attribution yet
Where
United States
Sectors
Finance, Consumers
Scale
one lender, over 1.2 million affected customers across at least five US states

Current status

As of September 1, public federal court dockets showed new breach-related lawsuits, but no report said the threat resumed or operations were disrupted.

Contained: The attack has been stopped or blocked. Recovery and investigation are still running.

Impact

Personal and financial data, including Social Security numbers, was stolen from a third-party cloud platform used by Heights Finance. No reports of the data being sold or misused have surfaced yet.

What to do

If you have a Heights Finance loan, watch for a breach notification letter and sign up for the free credit monitoring it offers, and consider placing a credit freeze given your Social Security number was exposed.

Timeline

  1. Sep 1, 2026

    A summons was issued to Heights Finance Holding Co in the Lane case. The dockets did not report a renewed intrusion or an operational outage.

    Containeddockets.justia.com
  2. Aug 31, 2026

    Kayla Lane filed another data-breach complaint against Heights Finance Holding Co in federal court.

    Containeddockets.justia.com
  3. Aug 26, 2026

    Shellis Martin filed a data-breach class-action complaint against Heights Finance Holding Co in federal court.

    Containeddockets.justia.com
  4. Aug 20, 2026

    Another class-action complaint was filed against Heights Finance Holding Co in federal court over the breach.

    Containeddockets.justia.com
  5. Aug 19, 2026

    Public federal court dockets showed several data-breach class-action complaints filed against Heights Finance Holding Co.

    Containeddockets.justia.com
  6. Aug 18, 2026

    SecurityWeek confirmed at least 1.2 million individuals were impacted, with state notifications showing hundreds of thousands of Texans among them.

    Containedsecurityweek.com
  7. Jul 30, 2026

    Heights Finance began notifying more than 1.2 million people that their personal and financial data was exposed.

    Containedsecurityaffairs.com
  8. May 7, 2026

    Heights Finance discovered unauthorized access to a third-party cloud platform storing customer data.

    Emergingsecurityaffairs.com

Sources

Related reports