Date: August 11, 2026

Notice of Data Breach

Heights Finance Holdings Co. (“Heights”) is encouraging individuals to take precautionary measures to protect their information following a security incident.

We encourage individuals to read this notice carefully, as it contains important details about the incident and steps you can take to help protect your information.

What Happened?

On May 7, 2026, Heights discovered that an unauthorized actor gained access to a cloud-based platform hosted by a third party that we use to store certain customer data. This activity was limited to the cloud-based platform only—it did not affect any of our loan management systems or other computer systems or networks. We immediately activated our incident response protocols, brought in outside cybersecurity specialists to investigate, and reported the incident to federal law enforcement.

We have since confirmed that the cloud-based platform is secure and that there is no ongoing security threat. Our operations were not impacted by this incident and have continued safely and securely.

What Information Was Involved?

Our investigation determined that an unauthorized actor may have viewed or copied certain information from the cloud-based platform. The specific information varies by individual, but may include one or more of the following:

• Contact Details: Name, address, phone number, or email address.
• Financial Information: Account details, bank account information (including bank name, account number, and routing number), or related financial data.
• Government Identifiers: This may include Social Security number, tax ID, driver’s license number, or state ID number.
• Additional Information: This may include date of birth or information voluntarily provided by a consumer, such as personal circumstances shared during customer service interactions.

Your information may be involved if you received a loan through Heights, or if you inquired about or applied for a loan product (including through a third party). Your information may also be involved if you were a former borrower of Curo Management or any of its former or current related brands.

What We Are Doing.

Upon discovering the incident, we moved quickly to investigate and ensure the security of our environment. Our investigation is now complete. We have confirmed that this activity was limited to the cloud-based platform only and did not affect any of our loan management systems or other computers systems or networks. The cloud-based platform is now secure and there is no ongoing security threat.

As a precaution, we have engaged a third-party cybersecurity specialist to monitor the dark web for any information that may have been involved in this incident. The dark web is a hidden part of the internet where unauthorized activities and data exchanges often occur. Our specialist is actively scanning dark web forums, marketplaces, and other platforms. As of this writing, they have not found any evidence that information involved in this incident is on the dark web.

We are also offering complimentary credit monitoring and identity protection services through a third-party provider, Epiq, to individuals who believe their information may be involved in this incident. We strongly encourage all such individuals to take advantage of these services. Enrollment instructions are provided in the “What You Can Do” section below.

What You Can Do.

We encourage individuals to review the steps outlined in this notice to protect their information. Cybersecurity is an ongoing concern for everyone, as companies worldwide face cybersecurity threats. By following the steps below, individuals can better protect themselves.

1. Enroll in Free Credit Monitoring

Epiq - Privacy Solutions ID: Heights is offering free credit monitoring and identity protection services through a third-party provider, Epiq, to individuals who believe their information may have been involved in this incident. Heights is paying the cost for these services for 24 months. Please see below for key features and enrollment instructions.

Key Features:

• 1-Bureau Credit Monitoring with Alerts. Monitors your credit file(s) for key changes, with alerts such as credit inquiries, new accounts, and public records.
• Dark Web Monitoring. Monitors one email address, phone, name, DOB, and SSN on the dark web. Includes retrospective report as well as ongoing monitoring.
• Credit Protection. 3-Bureau credit security freeze assistance with blocking access to the credit file for the purpose of extending credit (with certain exceptions).
• Change of Address Monitoring. Monitors the National Change of Address (NCOA) database and the U.S. Postal Service records to catch unauthorized changes to users’ current or past addresses.
• Identity Restoration & Lost Wallet Assistance. Dedicated ID restoration specialists who assist with ID theft recovery and assist with canceling and reissuing credit and ID cards.

How to Enroll:

1. Get Your Activation Code: Call Heights’ dedicated call center at 877-343-7785, Monday through Friday, 9:00 a.m. to 9:00 p.m. ET to receive your unique Activation Code.
2. Visit the Enrollment Website: Go to www.privacysolutionsid.com and click “Activate Account.”
3. Enter Your Activation Code: Input your unique Activation Code and complete the enrollment form and identity verification process.
4. Email Confirmation. You will receive a separate email from noreply@privacysolutions.com confirming your account has been set up successfully and will include an Access Your Account link in the body of the email that will direct you to the log-in page.
5. Enter Your Log-In Credentials. You will then be directed to your dashboard and activation is complete.

Deadline to Enroll: The deadline to enroll is November 9, 2026. After this date, the enrollment process will close, and your Epiq - Privacy Solutions ID code will no longer be active. Please enroll before the deadline to take advantage of these services.

Need Help? If you need assistance with the enrollment process or have questions regarding Epiq – Privacy Solutions ID, please call Epiq directly at 866-675-2006, Monday-Friday 9:00 a.m. to 5:30 p.m., ET. Please remember, however, that you will need to obtain your unique Activation Code first by calling Heights’ dedicated call center at 877-343-7785, Monday through Friday, 9:00 a.m. to 9:00 p.m. ET.

Important Information Relating to Enrollment: Epiq - Privacy Solutions ID may not be available for individuals who do not have established credit, a U.S. address (or one in its territories), or a valid Social Security number.

2. Review Your Accounts for Suspicious Activity.

We encourage you to remain vigilant by regularly reviewing your accounts and monitoring your credit reports for suspicious activity.

3. Order a Credit Report

If you are a U.S. resident, you are entitled under U.S. law to one free credit report annually from each of the three nationwide consumer reporting agencies. To order your free credit report, visit www.annualcreditreport.com or call toll-free at 1-877-322-8228. If you discover information on your credit report arising from a fraudulent transaction, you should request that the credit reporting agency delete that information from your credit report file. Contact information for the nationwide credit reporting agencies is provided below.

4. Contact the Federal Trade Commission, Law Enforcement and Credit Bureaus

You may contact the Federal Trade Commission (“FTC”), your state’s Attorney General’s office, or law enforcement, to report incidents of identity theft or to learn about steps you can take to protect yourself from identity theft. To learn more, you can go to the FTC’s website at www.identitytheft.gov; call the FTC at 1-877-438-4338; or write to the FTC Consumer Response Center at 600 Pennsylvania Avenue, NW, Washington, DC 20580.

5. Additional Rights Under the FCRA

You have rights pursuant to the Fair Credit Reporting Act, such as the right to be told if information in your credit file has been used against you, the right to know what is in your credit file, the right to ask for your credit score, and the right to dispute incomplete or inaccurate information. Further, pursuant to the Fair Credit Reporting Act, the consumer reporting agencies must correct or delete inaccurate, incomplete, or unverifiable information; consumer reporting agencies may not report outdated negative information; access to your file is limited; you must give your consent for credit reports to be provided to employers; you may limit “prescreened” offers of credit and insurance you get based on information in your credit report; and you may seek damages from violators. You may have additional rights under the Fair Credit Reporting Act not summarized here.

Identity theft victims and active-duty military personnel have specific additional rights pursuant to the Fair Credit Reporting Act. We encourage you to review your rights pursuant to the Fair Credit Reporting Act by: (i) visiting https://files.consumerfinance.gov/f/documents/bcfp_consumer-rights-summary_2018-09.pdf; or (ii) by writing to Consumer Financial Protection Bureau, 1700 G Street, NW, Washington, DC 20552.

6. Request Fraud Alerts and Security Freezes

You may obtain additional information from the FTC and the credit reporting agencies about fraud alerts and security freezes. You can add a fraud alert to your credit report file to help protect your credit information. A fraud alert can make it more difficult for someone to get credit in your name because it tells creditors to follow certain procedures to protect you, but it also may delay your ability to obtain credit. You may place a fraud alert in your file by calling just one of the three nationwide credit reporting agencies listed above. As soon as that agency processes your fraud alert, it will notify the other two agencies, which then must also place fraud alerts in your file.

In addition, you can contact the nationwide credit reporting agencies at the following numbers to place a security freeze at no cost to you:

Placing a security freeze prohibits the agency from releasing any information about your credit report without your written authorization. Security freezes must be placed separately at each of the three nationwide credit reporting agencies. When requesting a security freeze, you may need to provide the following information:

• Your full name, with middle initial as well as Jr., Sr., II, etc.
• Social Security number
• Date of birth
• Current address and all addresses for the past two years
• Proof of current address, such as a current utility bill or telephone bill
• Legible copy of a government-issued identification card, such as a state driver’s license, state identification card, or military identification.

After receiving your request, each agency will send you a confirmation letter containing a unique PIN or password that you will need to lift or remove the freeze. You should keep the PIN or password in a safe place.

Additional State-Specific Information

1. For Iowa Residents. You may contact law enforcement or the Iowa Attorney General’s Office to report suspected incidents of identity theft at: Office of the Attorney General of Iowa, Consumer Protection Division, Hoover State Office Building, 1305 East Walnut Street, Des Moines, IA 50319; 1-515-281-5164; and www.iowaattorneygeneral.gov.
2. For Maryland Residents. You can obtain information about avoiding identity theft from the Maryland Attorney General at: Maryland Office of the Attorney General Consumer Protection Division, 200 St. Paul Place Baltimore, MD 21202; 1-888-743-0023 (toll-free in Maryland) or 1-410-576-6300; www.marylandattorneygeneral.gov. Heights is located at 101 N. Main Street, Suite 600, Greenville, SC 29601 and can be contacted at 1-866-413-1836.
3. For New York Residents. You can obtain information about security breach response, identity theft prevention, and identity protection information from the New York State Office of the Attorney General at: Office of the Attorney General, The Capitol, Albany, NY 12224-0341; 1-800-771-7755 (toll-free) or 1-800-788-9898 (TDD/TTY toll-free line); https://ag.ny.gov/; and the Bureau of Internet and Technology (BIT), 28 Liberty Street, New York, NY 10005; 1-212-416-8433; and https://ag.ny.gov/internet/resource-center.
4. For North Carolina Residents. You can obtain information about avoiding identity theft from the North Carolina Attorney General at: North Carolina Attorney General’s Office 9001 Mail Service Center, Raleigh, NC 27699-9001; 1-877-566-7226 (toll-free in North Carolina) or 1-919-716-6400; and www.ncdoj.gov.
5. For Residents of Oregon. You may report suspected identity theft to law enforcement, including the Office of the Oregon Attorney General and the FTC. Contact information for the FTC is included in your notice. The Office of the Oregon Attorney General at: 1162 Court St. NE, Salem, OR 97301; 1-877-877-9392; and https://www.doj.state.or.us/.
6. For Rhode Island Residents. You can obtain information about avoiding identity theft from the Rhode Island Office of the Attorney General at: Rhode Island Office of the Attorney General, Consumer Protection Unit 150, South Main Street, Providence, RI 02903; 1-401-274-4400; and www.riag.ri.gov. You have the right to obtain a police report, and to request a security freeze (charges may apply), as described above. The approximate number of Rhode Island residents whose information was potentially involved in this incident was not known at the time of this notice.
7. For Washington, DC Residents. You can obtain information about avoiding identity theft from the Office of the Attorney General for the District of Columbia at: Office of the Attorney General for the District of Columbia, 400 6th Street NW, Washington, DC 20001; 1-202-727-3400; and www.oag.dc.gov. You have the right to request a security freeze (without any charge) as described above.

For More Information.

If you have concerns that are not addressed by this notice, we have established a dedicated toll-free call center for individuals to call should they have any additional questions or concerns. The call center can be reached at 877-343-7785, Monday through Friday, 9:00 a.m. to 9:00 p.m. ET.

Sincerely,

Heights