Confirmed facts and official announcement

Confirmed (official announcement): Heights Finance posted a Notice of Data Breach on Aug. 11, 2026 explaining that a cloud‑based system used by the company was accessed without authorization [1]. The notice is the company’s official statement to customers and regulators [1].

Confirmed (what data): Heights Finance says exposed data may include names, addresses, dates of birth, Social Security numbers, and bank routing and account numbers for a large group of customers [1][2].

Confirmed (scope reported): Company filings and its notice indicate the number affected is in the hundreds of thousands. Independent reporting summarizes the total as near 750,000, while the company describes the impacted pool as approximately 730,000 customers—this gap reflects different rounding and reporting points [1][3].

Independent reporting and legal follow‑up

Independent reporting: News outlets summarized regulatory filings and additional reporting has placed the likely affected population at nearly 750,000 customers, including the same categories of sensitive financial and identity data named by Heights Finance [3].

Class‑action and investigations: Law firms have announced investigations and possible class‑action filings on behalf of impacted individuals, and at least one firm publicly stated it is reviewing claims related to the incident on Aug. 12, 2026 [4].

How certain is this information?

• Official announcement: Confirmed—Heights’ notice and PR distribution are primary sources for what they say was exposed and when [1][2].
• Independent totals: Estimated—news reports combine filings and third‑party analysis to produce the ~750k figure; treat small differences in totals as estimates until regulators or the company finalize numbers [3].
• Ongoing developments: Likely—investigations and potential litigation mean details (exact totals, attacker method, timeline) could change as new filings appear [4].

What the breach means for consumers and small businesses

The practical risk from this cloud incident centers on identity theft and unauthorized withdrawals or fraud tied to exposed bank details. If your Social Security number or bank account numbers were included, attackers could attempt tax‑related identity theft, open accounts in your name, or try to drain business accounts via ACH transfers.

For small businesses that used Heights Finance services for payroll, lending, or account flows, the same risks apply to owner and employee records. Additionally, businesses may face operational disruption while reconciling transactions and communicating with banks and customers.

Immediate steps everyone should take now

Follow these prioritized actions promptly. These steps are practical measures based on the type of data exposed and standard identity‑theft remediation guidance.

1) Confirm whether you’re listed as affected (official):

Heights Finance is contacting impacted customers directly, and the company’s notice shows how to learn whether your records were included [1]. If you receive communication from Heights, confirm it using contact details on the company’s official site rather than links or phone numbers in unsolicited messages.

2) Freeze your credit and place fraud alerts (recommended):

• Credit freeze: Contact the three major U.S. credit bureaus (Equifax, Experian, TransUnion) to place a security freeze. A freeze prevents most new credit accounts from being opened in your name.
• Fraud alert: Alternatively, use an initial fraud alert if you need credit activity to continue but want extra monitoring.

3) Monitor accounts and change banking credentials (critical for exposed bank info)

If your bank routing and account numbers were exposed, contact your bank immediately, enable alerts for all transactions, and consider changing online banking passwords and multifactor authentication (MFA). Small businesses should coordinate with their bank’s fraud department to set additional ACH or wire transfer blocks if available.

4) Review IRS and tax protections (if SSNs exposed)

Because Social Security numbers were among the exposed data, consider applying for an Identity Protection PIN (IP PIN) with the IRS (if eligible) and monitor tax transcripts for suspicious filings. Contact the IRS if you suspect tax‑related identity theft; instructions and eligibility can change, so check current IRS guidance.

5) Watch for phishing and account‑takeover attempts

Attackers often follow breaches with targeted phishing. Verify the sender before clicking links or providing information. When in doubt, contact the organization directly using published contact methods. Enable MFA on all accounts that support it.

6) Consider paid credit monitoring and identity‑theft insurance (optional)

Heights Finance may offer complimentary monitoring to affected customers—check the company notice and PR communications for any free offers [2]. Even so, independent credit monitoring or identity‑theft insurance can provide extra detection and remediation support, though such services are not a substitute for freezes and bank coordination.

Steps specific to small businesses

Small businesses that used Heights Finance for payroll, merchant services, or lending have extra responsibilities.

• Notify employees and affected customers promptly if their data was involved—follow any legal notification obligations in your state.
• Contact your bank and payment processors to enable additional authentication, ACH blocks, or dual‑approval controls for outgoing transfers.
• Review access logs and credentials for any integrations with Heights Finance; rotate API keys, service account passwords, and MFA tokens used for integrations.
• Work with your accountant and insurer to watch for fraud and file claims if unauthorized transactions occur.

Short comparison: protections to consider now

How this incident happened — what’s public and what’s not

What the company says (official): Heights Finance’s notice states that an unauthorized party accessed a cloud environment. The company reported the incident and described the categories of data involved but did not publish detailed technical forensic findings in the public notice [1][2].

What independent reporting adds (independent reporting): Reporters reviewed regulatory filings and filings summarized the scope and categories of exposed data, but technical attribution—who accessed the environment, when, and how—has not been publicly confirmed as of Aug 20, 2026 [3].

Analysis (author): Cloud‑hosted systems remain a common target because they centralize large volumes of data. Immediate improvements often include rotating credentials, enforcing least‑privilege access, adding strong MFA to admin consoles, and ensuring timely vulnerability management. However, details of Heights’ internal controls and whether those measures were in place have not been published, so further investigation is needed before assigning blame.

What to watch next

• Updates from Heights Finance clarifying exact numbers and whether the company will provide free monitoring or remediation services [1][2].
• Regulatory filings and state attorney‑general notices that may provide more detail on the timeline and impacted systems [3][4].
• Any announced forensic reports identifying the attack vector, and guidance from banks about steps for commercial customers.

Practical checklist: 10 actions to take this week

1. Check Heights Finance’s official notice page to see if you were notified directly (confirmed source) [1].
2. Contact your bank if your account numbers were exposed; request fraud monitoring and change credentials.
3. Place a credit freeze with Equifax, Experian, and TransUnion if your SSN was exposed.
4. Enable MFA on all financial and email accounts today.
5. Sign up for any free monitoring Heights Finance offers, but still apply the protections above [2].
6. Monitor credit reports and bank statements daily for at least 12 months.
7. If you are a business, rotate API keys and change service account passwords for integrations with Heights Finance.
8. Review recent ACH and wire transfers and set dual‑approval for outgoing payments.
9. Be skeptical of unsolicited calls or emails claiming to be from Heights—verify using company contacts on their official site [1].
10. Document any suspicious activity and report it to your bank and local law enforcement if you suffer losses.

Bottom line

The Heights Finance data breach August 2026 is a confirmed cloud‑security incident affecting hundreds of thousands of U.S. customers and exposing extremely sensitive data categories, according to the company and independent reporting [1][3]. Act now: confirm whether you were notified, freeze or monitor credit, secure banking credentials, and expect ongoing updates as forensic and legal processes proceed [1][2][4].

Sources

Primary source: Heights Finance Notice of Data Breach (official) published Aug. 11, 2026 [1]. Additional coverage and filings summarized by news outlets and legal firms are cited throughout [2][3][4].

Frequently asked questions