Consumer lender Heights Finance Holdings Co. is notifying over 1.2 million people that their personal and financial information was stolen in a data breach.
In early May, Heights discovered that hackers accessed a third-party cloud-based platform used for customer data storage, the company said in an incident notice.
The loan provider says the platform has been secured and that its operations were not affected, as the incident was limited to the cloud-based platform.
“It did not affect any of our loan management systems or other computer systems or networks. We immediately activated our incident response protocols, brought in outside cybersecurity specialists to investigate, and reported the incident to federal law enforcement,” Heights says.
During the attack, the hackers accessed and stole personal and financial information, including names, addresses, email addresses, phone numbers, Social Security numbers, government ID numbers, driver’s license numbers, bank account information, account details, dates of birth, and other information customers shared with the company.
“Your information may be involved if you received a loan through Heights, or if you inquired about or applied for a loan product (including through a third party). Your information may also be involved if you were a former borrower of Curo Management or any of its former or current related brands,” the lender says.
Based on notices sent to the Attorney General’s Offices in several states, more than 1.2 million people have been affected: 734,828 in Texas, 486,463 in South Carolina, 26 in New Hampshire, and 21 in Vermont.
Heights is providing the affected individuals with 24 months of free credit monitoring and identity protection services.
According to the company, its monitoring of the dark web has found no evidence that the hackers have shared the information stolen in the attack.
Heights has not named the threat actor behind the data breach, and SecurityWeek has not seen any known ransomware or extortion group claiming responsibility for it.
Related: 680,000 Impacted by French Tax Authority Data Breach
Related: 40,000 Impacted by SafePal Data Breach
Related: Fortune 500 Companies Hit in Azure Data Theft Campaign
Related: 1.6 Million Likely Impacted by RingCentral Data Breach
