Heights Finance Data Breach Exposes SSNs and Sensitive Bank Information

Heights Finance Holdings Co. posted an 11 August 2026 notice after it found, on 7 May 2026, that an unauthorized actor had reached a third-party cloud used to store certain customer data.

The company says the activity stopped at that cloud and did not touch loan management systems or other Heights computers.

If you ever took a Heights loan, applied for one (even through a third party), or used to borrow from Curo Management or a related brand, treat name, Social Security number, and bank routing as possibly in the pile.

Call 877-343-7785 this week for the free 24-month Epiq code, then freeze Equifax, Experian, and TransUnion. The enroll window closes 9 November 2026. The freeze does not wait.

Overview

What broke

On 11 August 2026 Heights Finance Holdings Co. published its notice of data breach. The discovery date on that page is 7 May 2026. An unauthorized actor gained access to a cloud-based platform hosted by a third party that Heights uses to store certain customer data.

Heights says the activity was limited to that cloud. It did not affect loan management systems or other computer systems or networks. Heights activated incident response, brought in outside specialists, and reported the incident to federal law enforcement.

The company now says the platform is secure, there is no ongoing security threat, and operations were not impacted.

The investigation found that an unauthorized actor may have viewed or copied certain information from that cloud. What sits in any one file varies.

Heights lists name, address, phone, or email; account details, bank name, account number, and routing number; Social Security number, tax ID, driver’s license, or state ID; date of birth; and information a consumer volunteered in customer service.

As of the 11 August notice, Heights’ specialist has not found evidence this information is on the dark web. Do not wait for a dump story before you freeze.

Who is in range

You, if you received a loan through Heights. You, if you inquired about or applied for a loan product, including through a third party. You, if you were a former borrower of Curo Management or any of its former or current related brands.

A co-signer, an applicant who never funded, or a leftover Curo-brand account from years ago is still in range. The notice does not require a current open Heights loan.

What the vendor shipped

Heights is not shipping a firmware file or a patch for your PC. The offer is complimentary credit monitoring and identity protection through Epiq, called Privacy Solutions ID, for 24 months, with Heights paying.

The notice lists one-bureau credit monitoring, dark web monitoring of one email, phone, name, date of birth, and Social Security number, three-bureau freeze assistance, change-of-address monitoring, and identity restoration.

Enrollment is a phone call first. Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern, call 877-343-7785 and ask for your unique Activation Code. Then open the Privacy Solutions ID enrollment site, click Activate Account, enter the code, and finish the form.

The deadline is 9 November 2026. After that date the code is dead. If the form stalls, Epiq’s help line is 866-675-2006, Monday through Friday, 9:00 a.m. to 5:30 p.m. Eastern. You still need the Heights code first.

The product may not be available without established credit, a U.S. address (or one in its territories), or a valid Social Security number. A freeze at Equifax, Experian, and TransUnion does not depend on that product.

What this is not

• Not a hack of Heights’ loan management systems or other company computers. The notice limits the incident to the third-party cloud.
• Not ransomware on your PC. You do not need a cleanup tool, a scanner from a search ad, or a stranger offering to remove a virus you do not have.
• Not a confirmed dark-web dump. Heights’ specialist had not found the information on the dark web as of the 11 August notice.
• Not a reason to skip Equifax, Experian, and TransUnion. Monitoring sends alerts after activity appears. A freeze restricts access to your credit file and can make fraudulent new-credit applications harder.
• Not limited to people with a current Heights loan. Applicants and former Curo borrowers are in the same notice.

The code line is open. The freeze pages are already there. That is the cheap window.

Who can skip

• You were never a Heights customer, never applied, and were never a Curo Management borrower or a borrower of any former or current related brand.
• You already enrolled in the Epiq Privacy Solutions ID offer AND you already have a freeze in place at Equifax, Experian, and TransUnion.
• Monitoring without a freeze is not a skip. Freeze without the Epiq product is still a freeze. Do both unless the product will not enroll you, in which case freeze anyway.

Why it matters

A Social Security number plus a date of birth plus a driver’s license or a bank routing number is how someone opens credit, files a tax return, or tests a bank account. Heights stored that mix, for some people, in a third-party cloud that an outsider reached.

The loan software that still collects your payment was not the box that got hit. The archive was.

Monitoring works like a smoke alarm. It can warn you after an inquiry or new account appears. A security freeze restricts access to your credit file, which can make it harder for someone to open new credit in your name.

A freeze is free, but it must be placed separately at Equifax, Experian, and TransUnion. Each bureau manages its own recovery process, which may use an online account, password, PIN, or another verification method. Save every confirmation.

A fraud alert is different. It asks lenders to take additional identity-verification steps, while a freeze restricts access to the file itself. If the information named in the notice belongs to you, the freeze provides the stronger preventive layer.

Heights is paying for 24 months of Epiq identity protection. Use it, but do not treat monitoring as the whole response. The 9 November 2026 deadline applies to enrollment, not to the lifetime of the exposed information.

Review the Heights account and the bank account tied to the exposed routing information. Turn on transaction and ACH alerts, question unfamiliar debits immediately, and follow the bank’s advice if it recommends replacing the account number.

Important Follow-Up Checks After the Heights Finance Breach

Expect convincing follow-up scams

A criminal does not need every field in the breached file to sound believable. A correct name, lender, address, or partial account detail can make a phone call or email feel official. The caller may claim to help activate monitoring, reverse a debit, or finish a freeze.

Do not continue an inbound call that asks for a Social Security number, bank login, one-time code, or Activation Code. End the call and dial the number in Heights’ official notice or the number printed on your bank card.

Watch bank activity, not only credit reports

A credit freeze focuses on new credit. It does not block every possible misuse of an existing bank account or routing number. Review checking and savings activity, including small ACH debits that may be used to test whether an account is active.

Turn on transaction alerts where available. If an unfamiliar debit appears, contact the bank promptly through a trusted number and ask about the dispute process. The bank can explain whether monitoring is enough or whether the account number should be replaced.

Keep records of every protective action

Save the Heights Activation Code, Epiq enrollment confirmation, credit-freeze confirmations, bank case numbers, and copies of any dispute. Store them somewhere secure and separate from the inbox where a phishing message could trick you into revealing them.

Good records make later calls easier. They show when a freeze was placed, which bureau handled a dispute, and what the bank advised. They also reduce the chance that a scammer can confuse you with a false claim that no action was completed.

Review all three credit reports carefully

Look beyond unfamiliar accounts. Check names, addresses, employers, hard inquiries, and account balances. An incorrect address or inquiry may be an early sign that someone tried to use your identity even if a new account was not successfully opened.

If you find information that is not yours, document it and use the bureau’s formal dispute process. For confirmed identity theft, use IdentityTheft.gov to build a recovery plan. Avoid companies that demand upfront payment to perform steps consumers can complete directly.

Keep watching after the enrollment deadline

The 9 November 2026 date is the deadline for activating the complimentary service. It is not an expiration date for the exposed information. Social Security numbers, dates of birth, and identity-document details can remain useful to criminals for years.

Leave the freezes in place until you need to apply for legitimate credit, then lift only the necessary bureau for the shortest practical period. Continue reviewing alerts and statements, and treat future messages about the breach as untrusted until verified through official channels.

Complete Your Protection Steps

Call Heights for the code

1. Call 877-343-7785 from a phone you already use. Hours are Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern. Weekend calls wait.
2. Tell the agent you need the unique Activation Code for Heights Finance Privacy Solutions ID. This is the Heights call center, not Epiq yet.
3. Write the code down. You will type it once on the enrollment site. Do not paste it into a chat with a stranger who called you second.
4. If the line is busy, call back in the same window. Do not skip the code and try to invent one on the site.

Activate Privacy Solutions ID

1. Open the Privacy Solutions ID enrollment site. Click Activate Account. That button is the door. A random identity-protection ad is not.
2. Enter the Activation Code. Complete the enrollment form and the identity check the site asks for.
3. Watch for a separate email from noreply@privacysolutions.com confirming the account, with an Access Your Account link. Open that link, enter the log-in you just set, and confirm you land on a dashboard.
4. Deadline is 9 November 2026. After that date the enrollment process closes and the code is no longer active.
5. If the form fails, call Epiq at 866-675-2006, Monday through Friday, 9:00 a.m. to 5:30 p.m. Eastern. Bring the Heights code. Epiq cannot mint it for you.
6. If the product will not enroll you because you lack established credit, a U.S. address, or a valid Social Security number, stop trying to force it. Go freeze.

Freeze Equifax, Experian, and TransUnion

1. Open the Equifax credit freeze page. Choose Place a freeze. Complete the form with full name, Social Security number, date of birth, current address, and addresses for the past two years if asked. Save the confirmation and recovery information the bureau provides.
2. Repeat on the Experian freeze page.
3. Repeat on the TransUnion credit freeze page. One bureau does not freeze the other two. Save each confirmation and recovery method.
4. Then open the annual free credit report site and pull the free yearly file from each bureau. Look for accounts you did not open. If something is wrong, dispute it with that bureau and report identity theft at the FTC identity theft site.

What you should see

The Heights call should give you an Activation Code. The Privacy Solutions ID dashboard should confirm enrollment. Each credit bureau should separately confirm that its freeze is active and provide a way to manage or lift it later.

Keep those confirmations in a secure place. Do not pay a search-ad company to place a credit freeze, and do not give sensitive information to an inbound caller claiming to handle the process for you.

When you are done

You are done when you have the Activation Code, a Privacy Solutions ID enrollment confirmation or a documented reason enrollment failed, and separate freeze confirmations from all three bureaus. You have reviewed your credit reports and contacted the bank connected to the exposed account details.

Keep the records somewhere secure and continue watching for unfamiliar credit inquiries, accounts, ACH debits, and messages that use the breach as a pretext to request more information.

Frequently Asked Questions

Who may be affected by the Heights Finance data breach?

The notice covers people who received, requested, or applied for a Heights loan, including some former Curo Management borrowers and customers of related brands.

Is free credit monitoring enough?

No. Monitoring can alert you after suspicious activity appears. A security freeze at all three credit bureaus can make fraudulent new-credit applications harder.

Does a credit freeze cost money?

No. Equifax, Experian, and TransUnion allow consumers to place and lift security freezes for free. Complete the process separately with each bureau.

Which Heights Finance number should I call?

Call 877-343-7785 for the Heights Activation Code during the hours listed in the official notice. Use 866-675-2006 only for help with the Epiq enrollment process.

Will a security freeze close my existing credit cards?

No. A freeze restricts access to your credit file for new applications. It does not close existing accounts. Continue monitoring current cards, loans, and bank statements for unauthorized activity.

What if I did not receive a Heights letter?

If you previously borrowed from or applied through Heights, Curo Management, or a related brand, use the contact information on Heights’ official notice to ask whether your information is involved.

The Bottom Line

The Heights Finance incident may involve identity details and bank information that remain sensitive long after the enrollment deadline. The free Epiq service is useful, but monitoring alone is not a complete response.

Use the official Heights number, freeze all three credit files, review your reports, and contact the bank tied to any exposed account details. Keep the confirmations and treat follow-up calls or emails as untrusted until independently verified.