CURO Group Holdings (now Attain Finance / Heights Finance; former Speedy Cash parent)

CURO went through a prepackaged Chapter 11 in 2024. Its NYSE stock was suspended and delisted, and it deregistered with the SEC in March 2024. It had already sold its U.S. Speedy Cash business to CCF Holdings in 2022. Its U.S. branches now operate as Heights Finance. On Aug. 11, 2026, Heights posted a data-breach notice: an unauthorized actor accessed a third-party cloud platform (discovered May 7, 2026), and the exposed data may include Social Security numbers, driver's license numbers and bank account and routing numbers. The notice says former borrowers of 'Curo Management or any of its former or current related brands' may be affected, which could reach people who borrowed from Speedy Cash before the 2022 sale.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-10-16

Primary source. www.heightsfinance.com/importantinfo — Unverified - heuristic first draft.

Arbitration

Not verified this pass (Heights/Attain loan terms not reviewed).

Data sharing

DATA BREACH (2026): Heights Finance Holdings Co. notice dated Aug. 11, 2026. An unauthorized actor gained access to a third-party-hosted cloud platform used to store customer data; Heights discovered it May 7, 2026. Data that may have been viewed or copied: name, address, phone, email; bank account details including bank name, account number and routing number; Social Security number, tax ID, driver's license or state ID number; date of birth; and 'personal circumstances shared during customer service interactions.' Scope includes loan applicants (including through third parties) and former borrowers of Curo Management or its related brands. Heights offers 24 months of Epiq credit monitoring. The number of people affected and any state AG breach-list filings were not verified this pass. This is another third-party vendor-chain incident, and the data (SSN plus bank routing details) is the combination most useful for account takeover and fraudulent ACH debits.

Contacts

Privacy contact. Breach-notice support via Epiq Privacy Solutions ID (privacysolutionsid.com) per Heights notice; corporate privacy contact not verified.

Legal notice. Last SEC-reported address (2024): 200 W Hubbard Street, 8th Floor, Chicago, IL 60654 (CURO 8-K); likely outdated after restructuring. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.