Heights Finance Data Breach: SSNs and Bank Data Exposed — Is There a Lawsuit? (August 2026)
The consumer lender behind Heights Finance, Covington Credit, Quick Credit and Southern Finance discovered a cloud-platform breach in May 2026 — Social Security numbers and full bank account details may be out. Class-action firms are investigating. No settlement exists yet — this tracker follows the case.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened at Heights Finance
On or about May 7, 2026, Heights Finance Holdings Co. — a Greenville, South Carolina consumer lender operating as Heights Finance, Covington Credit, Quick Credit and Southern Finance — discovered that an unauthorized actor had accessed a third-party cloud platform the company used to store customer data. The company says the intrusion was limited to that cloud platform and did not touch its loan-management systems. Per the company's own disclosure, the exposed data may include names, addresses, phone numbers, email addresses, account details, bank account information (bank name, account number and routing number), Social Security numbers, tax identification numbers, driver's license numbers, state ID numbers and dates of birth — the combination that enables both identity theft and direct bank fraud. How many people are affected has not been disclosed.
Case Details
As of August 17, 2026, no class action is confirmed filed. National class-action firms — including Edelson Lechtzin LLP (announcement August 12, 2026) — are investigating and collecting affected borrowers for a potential suit. The affected group is broad: anyone who received a loan, applied or inquired (including through third parties), plus former borrowers of Curo Management and its related brands. This page tracks the docket from the first complaint on.
Current Status — Verified August 17, 2026
Who Is Affected?
Potentially affected per the company's disclosure: anyone who received a loan through Heights Finance or its brands (Covington Credit, Quick Credit, Southern Finance), anyone who applied for or inquired about a loan — including through a third party — and former borrowers of Curo Management or its related brands. The total count is not disclosed. If you receive a notification letter from Heights Finance, keep it — it is your proof of membership for anything that follows.
What Could This Pay? (Honest Answer)
Case Timeline
- 1
On or about May 7, 2026: Breach discovered
Heights Finance discovers unauthorized access to a third-party cloud platform storing customer data. When the intrusion began has not been stated.
- 2
May–July 2026: Internal review
The company determines the scope: loan-management systems reportedly untouched, but the cloud platform held extensive borrower records across all four brands.
- 3
August 2026: Public disclosure
The breach becomes public through the company's disclosure describing the exposed data categories — including SSNs and full bank account details.
- 4
August 12, 2026: Class-action firms open investigations
Edelson Lechtzin LLP announces an investigation and begins signing up affected borrowers, including former Curo customers.
- 5
Expected: individual notification letters
State breach laws require individual notice. Letters define who is officially affected — keep yours.
- 6
Expected: first complaints
Breaches with SSN-plus-banking exposure at consumer lenders historically draw filings within weeks to months of disclosure.
- 7
What's next
First complaint, likely consolidation if several follow, then the standard breach-litigation path. We update this page at each milestone.
Heights Finance Breach Scams — High Danger
This breach is a scammer's dream scenario: criminals may hold real loan details, bank account numbers and SSNs of people who — as borrowers at an installment lender — are attractive targets for fake debt-collection fraud.
Fake debt collectors quoting your real loan
Callers may cite your genuine loan details and demand immediate payment. Heights Finance and legitimate collectors don't demand gift cards, wire transfers or crypto. Hang up and call your branch directly using the number on your statement.
Fake 'Heights Finance settlement claim' sites
No settlement, no claims portal, no fund exists. Any payout form circulating today is a scam. A real claims process will appear in court filings — and on this page.
Bank 'verification' calls
With account and routing numbers exposed, expect calls pretending to be your bank 'verifying' your identity. Your bank never needs you to read back full account credentials or one-time codes. Hang up, call the number on your card.
Heights Finance Data Breach FAQs
Is there a Heights Finance data breach settlement?
No. As of August 17, 2026 there is no settlement, no claims administrator, no fund — and no confirmed filed complaint. Class-action firms are investigating. Bookmark this page; we update it when a complaint is filed or anything payable exists.
I borrowed from Covington Credit / Quick Credit / Southern Finance — am I included?
Yes — all four brands run on Heights Finance's systems, and the company's disclosure covers borrowers, applicants and inquirers across them, plus former Curo Management borrowers.
What data was exposed?
Per the company's own disclosure, potentially: names, addresses, phone numbers, emails, account details, bank account information including routing numbers, Social Security numbers, tax IDs, driver's license and state ID numbers, and dates of birth. Your notification letter should state which fields were in your record.
My bank account number was in there. What do I do?
Call your bank now — not after something happens. Ask to flag or reissue the account, enable transaction alerts, and dispute unknown ACH withdrawals immediately (ACH disputes have short windows). This is the one exposure type where waiting costs real money.
How many people are affected?
Not disclosed. Heights Finance operates across multiple states through four brands, and the affected group includes past applicants and former Curo borrowers — the notification wave and future court filings will reveal the true scale. We'll update this page when a number exists.
What could a settlement pay per person?
Unknown today. SSN-plus-banking breaches sit in the serious tier: comparable settlements have paid flat amounts plus documented-loss reimbursement (often up to several thousand dollars for proven fraud losses). Documentation decides everything — keep records.
Do I need to sign up with a law firm now?
No — if a class action is filed and settles, class members are covered automatically. Individual counsel becomes worth it only if you suffer serious, documented fraud traceable to this breach.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.