Heights Finance Breach Exposes 1.2 Million via Unsecured Third-Party Cloud Storage

Heights Finance Holdings discovered the intrusion on a cloud-based customer data platform in early May. Attackers extracted extensive personal and financial records but left core loan management systems untouched. The company activated incident response, engaged external forensics, and notified law enforcement while securing the platform. State filings confirm the scale: 734,828 individuals in Texas and 486,463 in South Carolina alone.

Procurement and incident records show Heights relies on external cloud storage for customer data aggregation, a pattern repeated across CURO Management brands. No CVE or known ransomware group has been linked, and dark web monitoring reportedly found no resale activity. This absence of attribution evidence contrasts with official statements that downplay ongoing exposure risk.

Third-party cloud configurations remain a recurring failure point in consumer finance, enabling bulk exfiltration without direct system compromise. Similar incidents at other lenders indicate that regulatory filings often understate downstream identity fraud windows. Affected parties received only 24 months of monitoring despite the permanence of SSN and bank data.

Expect state attorneys general to demand detailed forensic reports within 60 days. Heightened scrutiny on cloud vendor contracts will follow if additional states file notices exceeding the current 1.2 million total.