Heights Finance Holdings began notifying more than 1.2 million people in August 2026 that their personal and financial information was stolen in a May 2026 breach of a third-party cloud platform. Exposed data includes Social Security numbers, bank account and routing numbers, driver's license numbers, and loan details across the Heights Finance, Covington Credit, Quick Credit, and Southern Finance brands. Freeze your credit at all three bureaus today, enroll in the free 24-month Epiq Privacy Solutions ID monitoring before the November 9, 2026 deadline, and cut your data-broker footprint so attackers cannot cross-reference the leak.
What Happened in the Heights Finance Data Breach?
The timeline:
- Prior to May 2026: An unauthorized actor gained access to a cloud-based platform hosted by a third party that Heights Finance used to store certain customer data.
- May 7, 2026: Heights Finance detected the unauthorized access and launched a forensic investigation with third-party responders.
- May–July 2026: Forensic review to identify what data was accessed and who was affected. Regulators and law enforcement were notified.
- August 2026: Heights Finance began mailing individual notification letters to at least 1.2 million people and posted a public breach notice at heightsfinance.com/importantinfo.
- November 9, 2026: Deadline to enroll in the free 24-month identity protection service Heights Finance is offering through Epiq Privacy Solutions ID.
Heights Finance is a consumer installment lender operating in more than a dozen U.S. states. Your data may be involved if you received a loan through Heights, or if you inquired about or applied for a loan (including through a third party) with Heights Finance, Covington Credit, Quick Credit, or Southern Finance.
What Data Was Exposed?
Per Heights Finance's notification letters, the compromised data may include:
- Full name and date of birth
- Home address, phone number, and email
- Social Security number
- Tax ID number
- Driver's license number or state ID number
- Bank account information — bank name, account number, routing number
- Loan account details and loan history
- Information voluntarily provided during customer service interactions (personal circumstances shared with agents)
Why the Heights combination is so dangerous
SSN plus bank account plus routing number plus driver's license is the perfect combination for both new-account identity theft and ACH fraud — a criminal can open new credit lines in your name and also drain existing accounts. The free-text notes agents captured during customer service are also unusually revealing ("lost my job in April," "caring for a sick parent") and make follow-on phishing far more convincing. Treat this breach as high severity.
Are You Affected?
Assume affected if any of the following are true:
- You received a notification letter from Heights Finance, Covington Credit, Quick Credit, or Southern Finance in August 2026
- You ever took out a loan with one of those brands
- You inquired about or applied for a loan through Heights or a third-party loan-matching site that forwarded your application to Heights
If you did not get a letter but you suspect you applied through a third party, call Heights Finance's dedicated breach hotline (listed on heightsfinance.com/importantinfo) to check.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Immediate Steps to Take
Step 1: Freeze Your Credit at All Three Bureaus
Because SSNs and driver's license numbers were exposed, a credit freeze is the single most important action. It is free, reversible, and blocks new accounts opened in your name. Freeze at all three bureaus:
Step 2: Enroll in Free Epiq Monitoring Before November 9, 2026
Heights Finance is offering 24 months of complimentary credit monitoring and identity protection through Epiq Privacy Solutions ID (a legitimate breach-response administrator; see our Epiq review). Use the enrollment code in your letter and enroll at the URL printed on the letter — not any link emailed to you. The offer expires November 9, 2026.
Step 3: Protect Your Bank Accounts
Because your bank name, account number, and routing number are in the exposed set, ACH fraud is the biggest short-term risk. This week:
- Call your bank, tell them your account was in the Heights Finance breach, and ask them to add ACH block/positive-pay protection
- Consider closing and reopening the exposed account if your bank supports it easily
- Turn on transaction alerts for every debit above $1 so you see fraud in real time
- Watch for small "test" deposits or withdrawals — a common precursor to a large drain
Step 4: Watch for Loan-Themed Phishing
Expect scams that name your real loan servicer and reference your real loan amount or hardship notes. Rules for the next 90 days:
- No legitimate lender will ever call asking for your full SSN or bank password — hang up
- Do not click links in "Heights Finance" or "Epiq" emails; type the URL yourself
- If a caller pressures you to "secure your account" by moving money, that is the scam
Step 5: Move 2FA Off SMS
Phone numbers were exposed, which enables SIM-swap attacks aimed at intercepting SMS 2FA codes. Switch 2FA on your bank, email, and any lending portals from SMS to an authenticator app (Google Authenticator, Authy, 1Password, Bitwarden) or a hardware security key (YubiKey, Google Titan). Add a port-out PIN with your mobile carrier.
Cut the Trail: Remove Your Data From Broker Sites
The Heights Finance leak by itself gives attackers your identity and financial data. It becomes far more dangerous when paired with data-broker records — relatives, past addresses, employer history — which they can buy for pennies on Spokeo, BeenVerified, Whitepages, and 100+ similar sites. Data brokers also make loan-themed phishing much more convincing ("Hi <full name>, calling about your loan at <address>, we see your mother <name> co-signed").
PrivacyOn shrinks your public footprint fast
PrivacyOn removes your personal information from 100+ major data broker sites, adds 24/7 dark web monitoring so you know when your info surfaces in new dumps, and covers up to 5 family members from $8.33/month. Start with a free scan to see exactly which brokers are exposing your address, phone, and relatives — the same data attackers will try to combine with the Heights Finance leak. Epiq's free monitoring alerts you after fraud has occurred; PrivacyOn shrinks the surface first, which is what stops most opportunistic attackers.
Longer-Term Protection
- File your taxes early next season — SSN leaks fuel tax-refund fraud, and being first in the queue with the IRS closes the window
- Request an IRS Identity Protection PIN (IP PIN) so no one can file a return in your name without it
- Set fraud alerts at all three credit bureaus as a supplement to the freeze
- Get free weekly credit reports at AnnualCreditReport.com and read every entry
- Report suspected identity theft at IdentityTheft.gov for a free FTC recovery plan
Frequently Asked Questions
Is the Heights Finance 2026 data breach confirmed?
Yes. Heights Finance publicly disclosed the breach in August 2026 after detecting unauthorized access on May 7, 2026 to a third-party cloud platform holding customer data. The company began mailing individual notification letters in August 2026 and posted a formal notice at heightsfinance.com/importantinfo.
How many people are affected by the Heights Finance breach?
At least 1.2 million people according to public disclosures and state Attorneys General filings in August 2026. The final number could grow as forensic work continues.
Which brands are covered by the Heights Finance breach?
Heights Finance operates under several brands, all covered by the breach: Heights Finance, Covington Credit, Quick Credit, and Southern Finance. If you took out or applied for a loan under any of those names, treat yourself as potentially affected.
What information was exposed in the Heights Finance breach?
Names, dates of birth, addresses, phone numbers, Social Security numbers, tax IDs, driver's license numbers, state IDs, bank account and routing numbers, loan account details, and personal circumstances voluntarily shared with customer service.
Is the free Epiq Privacy Solutions ID monitoring worth signing up for?
Yes — enroll before the November 9, 2026 deadline. Epiq Privacy Solutions ID is a legitimate breach-response service; the 24-month enrollment includes credit monitoring, identity restoration, and identity theft insurance at no cost. But Epiq monitoring is reactive; for proactive protection that shrinks the attack surface before fraud happens, pair it with a data-broker removal service.
Do I need to freeze my credit after the Heights Finance breach?
Yes — SSNs, driver's licenses, and bank account numbers were exposed, so a credit freeze at Equifax, Experian, and TransUnion is essential. Freezes are free, take minutes to place, and can be temporarily lifted when you need to apply for credit.
Can I sue Heights Finance over the 2026 breach?
Multiple plaintiffs' firms announced investigations into potential class actions in August 2026. If you are affected, save your notification letter and any related correspondence; you may qualify to join a class action later. This is not legal advice — consult an attorney for your situation.
Is there a service that can shrink my exposure after a breach like this?
Yes — PrivacyOn is our top pick. It removes your personal information from 100+ data broker sites so attackers cannot cross-reference the Heights Finance leak with your current address, phone, and relatives, adds 24/7 dark web monitoring for your email and SSN, and covers up to 5 family members from $8.33/month. Epiq monitoring only alerts you after fraud has happened; PrivacyOn shrinks the exposed surface first, which is what stops most opportunistic attackers from picking your record out of the Heights Finance dump.