Almeida Law Group is investigating a data breach at Heights Finance Holdings Co. The breach occurred on March 13th, 2026 – May 7th, 2026 and was discovered on May 7th, 2026. If you were affected, contact Almeida Law Group.
About Heights Finance Holdings Co.
Heights Finance Holdings Co. is a consumer credit lender headquartered in Greenville, South Carolina, that offers personal installment loans, auto loans, and debt consolidation products. The company operates more than 400 branch locations across 11 states under several brands, including Heights Finance, Covington Credit, Quick Credit, and Southern Finance. It is a subsidiary of Attain Finance, formerly known as CURO Group Holdings Corp., and was itself formerly known as Southern Management Corporation. Because Heights Finance extends credit directly to consumers, it collects and retains extensive personal and financial information as part of its lending operations.
What Happened?
Heights Finance Holdings Co. was listed in a Texas Attorney General data security breach report (record BR-0005250). On May 7th, 2026, the company discovered that an unauthorized actor had gained access to a cloud-based platform hosted by a third party that was used to store certain customer data. The breach period ran from March 13th, 2026 through May 7th, 2026. Heights Finance stated that the unauthorized activity was confined to that third-party cloud platform and did not affect its loan management systems or other internal computer systems or networks. The company activated incident response protocols, engaged outside cybersecurity specialists, and reported the matter to federal law enforcement. A total of 4,132,834 individuals were affected. Heights Finance began notifying affected individuals on August 11th, 2026—approximately three months after discovery. No ransomware group or specific threat actor has been publicly attributed to this incident.
The compromised information includes names, addresses, phone numbers, email addresses, bank account information (including bank name, account number, and routing number), Social Security numbers, tax identification numbers, driver’s license numbers, state identification numbers, dates of birth, and account details. Heights Finance is offering 24 months of free credit monitoring and identity protection services through Epiq, with an enrollment deadline of November 9th, 2026. As of August 14th, 2026, no class action lawsuit has been filed in connection with this breach, though multiple law firms—including Edelson Lechtzin LLP, Federman & Sherwood, Cole & Van Note, and Console & Associates, P.C.—have announced investigations into potential class action claims on behalf of affected individuals. Separately, in August 2023, the Consumer Financial Protection Bureau filed a lawsuit against Heights Finance concerning alleged loan-refinancing practices; that case was voluntarily dismissed with prejudice on February 27th, 2025, and was unrelated to this data security incident.
Key Facts at a Glance
- Company or Organization: Heights Finance Holdings Co.
- Industry: Consumer Finance / Consumer Lending
- Location: Greenville, South Carolina
- Incident type: Unauthorized access to a third-party cloud-based platform
- Date of breach: March 13th, 2026 – May 7th, 2026
- Date breach discovered: May 7th, 2026
- Date of consumer notification: August 11th, 2026
- Total persons affected: 4,132,834
- Identity theft protection offered: 24 months of free credit monitoring and identity protection through Epiq
- Enrollment deadline: November 9th, 2026
- Prior breach: None identified
- Litigation status: No class action filed as of August 14th, 2026; investigations announced by Edelson Lechtzin LLP, Federman & Sherwood, Cole & Van Note, and Console & Associates, P.C.
- Source: Texas Attorney General data security breach report (BR-0005250), oag.my.site.com; Heights Finance official notice, heightsfinance.com; PR Newswire press release, prnewswire.com
What Should You Do?
If you received a notice from Heights Finance Holdings Co., you should enroll in the 24 months of free credit monitoring and identity protection being offered through Epiq before the November 9th, 2026 deadline. Because the breach exposed Social Security numbers, bank account numbers, routing numbers, and driver’s license numbers, you should also consider placing a fraud alert or a credit freeze with each of the three major credit bureaus—Equifax, Experian, and TransUnion. Review your bank and financial account statements closely for any unauthorized transactions and request your free credit reports at AnnualCreditReport.com to check for accounts or inquiries you do not recognize. If you suspect your information is being misused, visit IdentityTheft.gov for step-by-step guidance on reporting identity theft and protecting yourself going forward.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
