Heights Finance Cloud Platform Breach Exposes 1.2 Million Borrowers' Data
Hackers accessed a third-party cloud platform used by Heights Finance Holdings to store customer records, exposing Social Security numbers, driver's licenses, and bank account details of over 1.2 million individuals.
VaultTools · August 20, 2026
Table of Contents
- What happened
- What was exposed
- How it happened
- The disclosure timeline
- Why this matters for browser-based file tools
- Sources
What Happened
Heights Finance Holdings, a consumer lender headquartered in Greenville, South Carolina, has begun notifying over 1.2 million individuals that their personal and financial data was stolen after hackers compromised a third-party cloud platform the company used to store customer records. The breach also affects former borrowers of Curo Management and related brands, according to SecurityWeek.
State-level filings show 734,828 people affected in Texas and 486,463 in South Carolina, with smaller numbers in other states.
What Was Exposed
The compromised data includes names, addresses, email addresses, phone numbers, Social Security numbers, driver’s license and state ID numbers, bank account and routing numbers, dates of birth, and information disclosed during customer service interactions, according to Malwarebytes.
The combination of government identifiers, banking details, and personal circumstances shared during support calls creates what analysts describe as a high-risk profile for identity fraud, account takeover, and targeted social engineering.
How It Happened
On May 7, 2026, Heights Finance discovered that “an unauthorized actor gained access to a cloud-based platform hosted by a third party that we use to store certain customer data,” according to the company’s notice. The investigation, conducted with outside cybersecurity specialists, determined the intruder “may have viewed or copied information in that environment.”
Heights Finance stressed that the incident was limited to the external cloud platform. “It did not affect any of our loan management systems or other computer systems or networks,” the company stated. No ransomware group has claimed responsibility, and dark web monitoring has found no evidence of the data being published so far.
The Disclosure Timeline
The breach was discovered on May 7, 2026. Heights Finance engaged external cybersecurity specialists and notified federal law enforcement. Notification letters began reaching affected individuals on August 11, 2026, over three months after discovery. The company is offering 24 months of complimentary credit monitoring and identity protection services through Kroll.
Why This Matters for Browser-Based File Tools
This breach follows a familiar pattern: sensitive personal documents, from bank account details to government-issued IDs, were collected, uploaded to a cloud platform, and stored there indefinitely. When that platform was compromised, everything stored on it became available to the attacker.
The core vulnerability is not the cloud platform itself but the assumption that collected documents must be stored remotely. Browser-based, client-side processing offers a different model: a file that is read, transformed, or validated in the user’s browser never leaves the device. There is no cloud copy to steal, no third-party storage to misconfigure, and no months-long window during which exfiltrated data sits undetected. For any workflow where the goal is to process a document rather than archive it, local processing removes the storage risk entirely.