HEIGHTS Finance has disclosed that a breach of a third‑party cloud platform exposed the personal and financial data of more than one million individuals, as noted in its notice on the company website here. The incident was first detected on 18 August 2026 and the company urged affected customers to take protective steps.
According to a report by Malwarebytes detailing the breach, the breach stemmed from unauthorized access to a cloud storage service used by a vendor, compromising names, addresses, Social Security numbers and bank account details. Heights Finance said its core loan management systems were not touched and no CVE identifiers have been assigned to the flaw. The exposed information could be used for identity theft or fraudulent financial activity.
A SecurityWeek article notes that although the intrusion was discovered in early May, public disclosure came weeks later after the company secured the vulnerable platform and found no trace of the stolen data on dark‑web markets. No threat actors have been named and the method of entry remains undisclosed. The firm is offering affected individuals twenty‑four months of free credit monitoring and identity‑protection services.
The episode highlights the risks that arise when sensitive data is entrusted to third‑party cloud providers without adequate oversight. Similar incidents have shown that weaknesses in vendor access controls can lead to large‑scale exposure even when the primary network remains secure.
For those whose data may have been taken, experts recommend enrolling in the offered credit‑monitoring service, reviewing bank and credit‑card statements for unfamiliar activity and considering a fraud alert or credit freeze with the major bureaus. Customers should also be wary of unsolicited emails or texts that request personal information, as attackers often use breach details to craft convincing phishing lures.
Organizations that rely on external cloud services should verify that vendors enforce strong authentication, encrypt data at rest and in transit, and maintain detailed access logs. Regularly reviewing third‑party permissions and conducting independent security assessments can help detect misconfigurations before they are exploited. Maintaining an up‑to‑date incident‑response plan ensures a swift reaction if a similar event occurs.