Heights Finance Holdings Co., a consumer lending firm, has announced that a significant data breach has compromised the personal and financial information of over 1.2 million individuals. The breach was discovered in early May when unauthorized access to a third-party cloud platform used for storing customer data was detected.
Details of the Cybersecurity Incident
The breach was confined to the cloud-based platform, with Heights Finance confirming that their core business operations and loan management systems remained unaffected. The company promptly initiated its incident response strategy, enlisting the help of external cybersecurity experts and reporting the breach to federal authorities.
The compromised data includes sensitive information such as names, addresses, email addresses, phone numbers, Social Security numbers, government ID numbers, driver’s license numbers, bank details, account information, and birth dates.
Impacted Parties and Geographic Scope
This breach potentially affects anyone who has obtained a loan through Heights Finance or has inquired about loan products, including past customers of Curo Management and its associated brands. Specific state notifications reveal that 734,828 individuals in Texas, 486,463 in South Carolina, 26 in New Hampshire, and 21 in Vermont were impacted.
To mitigate the impact, Heights Finance is offering 24 months of free credit monitoring and identity protection services to those affected.
Current Status and Response
While the identity of the hackers remains unknown, Heights Finance has not observed any indications that the stolen information has been distributed on the dark web. As of now, no ransomware or extortion groups have claimed responsibility for the breach.
Related instances of data breaches continue to highlight vulnerabilities. Similar incidents have occurred with the French Tax Authority, SafePal, and RingCentral, affecting hundreds of thousands of individuals.
As the situation develops, Heights Finance remains committed to safeguarding customer data and improving its security measures to prevent future breaches.
