HackingFinancial ServicesTechnologyFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)LowContained

Gravity Payments, Inc.

bd_77941f9c91b544c7 · schema v1 · pii pii-v2

Severity

Low

Discovered

Aug 22, 2025

Filed

Feb 4, 2026

To disclose

—

Affected

Not disclosed

Linked

7 filings

Confidence

66%

Full breach record for Gravity Payments, Inc. →

Gravity Payments, Inc. notified Nebraska residents of a data security incident occurring on or around August 22, 2025. A third-party service provider's software vulnerability allowed an unknown actor to access Gravity's CRM files. The investigation, completed January 15, 2026, confirmed that customer names and additional personal information may have been affected. Gravity secured systems, revoked third-party access, notified law enforcement, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 22, 2025

Begins

Aug 22, 2025

Discovered

Feb 4, 2026

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

New Hampshire State AGbd_3da9b854cc85c0572026-02-04Verified
Indiana State AGbd_6e88a223a7c3669a2026-02-04Candidate
Massachusetts State AGbd_866480be2b95c0462026-02-04Verified
Maine State AGbd_96eadfe6168c41092026-02-04Verified

Show 2 more filings ↓

Vermont State AGbd_da75719f3caa78112026-02-04Verified
Washington State AGbd_e0e4a5b9da0c668d2026-02-04Verified

Name: Gravity Payments, Inc.
norm: gravity payments
Domain: gravitypayments.com

Name: Gravity Payments, Inc.
norm: gravity payments
Domain: gravitypayments.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Aug 22, 2025
Breach occurred: Aug 22, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: notified law enforcement
Initial access: supply_chain

During the incident: Secured our systems
Permanently revoked the third-party service provider’s access to our data
Notified law enforcement
Provided you with access to [Extra3] months of credit monitoring and identity restoration services through Experian
Changes made: Provided you with access to [Extra3] months of credit monitoring and identity restoration services through Experian
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

New Hampshire State AGFeb 4 · first

Indiana State AGFeb 4 · first

Massachusetts State AGFeb 4 · first

Maine State AGFeb 4 · first

Vermont State AGFeb 4 · first

Washington State AGFeb 4 · first

Nebraska State AGFeb 4 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/1e767401-3bce-41d6-883c-e4b0b4cfd7aa.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 4, 2026
Raw hash: 27f55644ded2af9bc2a617f85df922d50a05a2c2c57ff4a3b284a6288eaea48c

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityGravity Payments, Inc.

Victim entityGravity Payments, Inc.

Incidentdiscovered Aug 22, 2025

Stated responseSecured our systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov