HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)MediumContained

Gravity Payments, Inc.

bd_96eadfe6168c4109 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 22, 2025

Filed

Feb 4, 2026

To disclose

24 weeks

Affected · nationwide

2,27814 in this filing

Linked

7 filings

Confidence

66%

Full breach record for Gravity Payments, Inc. →

Gravity Payments, Inc. reported an external system breach (hacking) occurring between August 12-23, 2025, discovered on August 22, 2025. An unknown actor accessed files in Gravity's CRM software via a third-party service provider vulnerability. Approximately 2,278 individuals were affected, including 14 Maine residents. The incident involved basic PII (names). Gravity secured systems, revoked vendor access, notified law enforcement, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 22, 2025 → Filed with AG Feb 4, 2026166d ✗ ME AG >90d24 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 10 days

discovery → filing · 24 weeks / 166 days

Aug 12, 2025

Begins

Aug 22, 2025

Discovered

Feb 4, 2026

Filed

vs. sector median

+15 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

New Hampshire State AGbd_3da9b854cc85c0572026-02-04Verified
Indiana State AGbd_6e88a223a7c3669a2026-02-04Candidate
Nebraska State AGbd_77941f9c91b544c72026-02-04Verified
Massachusetts State AGbd_866480be2b95c0462026-02-04Verified

Show 2 more filings ↓

Vermont State AGbd_da75719f3caa78112026-02-04Verified
Washington State AGbd_e0e4a5b9da0c668d2026-02-04Verified

Name: Gravity Payments, Inc.
norm: gravity payments
Domain: gravitypayments.com

Name: Gravity Payments, Inc.
norm: gravity payments
Domain: gravitypayments.com
Industry: Financial Servicesllm

Discovered: Aug 22, 2025
Breach occurred: Aug 12, 2025 – Aug 23, 2025
Undetected for: 10 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 4, 2026
Affected individuals: 2,278state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Initial access: supply_chain

During the incident: Secured our systems
Permanently revoked the third-party service provider’s access to our data
Notified law enforcement
Launched an investigation with the assistance of third-party cybersecurity experts
Changes made: Providing 12 months of credit monitoring and identity restoration services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(166 days from discovery to filing)
Compliance flags: ME AG >90d · 166dME resident >60d · 166d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 22, 2025
→ Filed with AG: Feb 4, 2026
166d 90 days ME AG >90d
Maine
Discovered: Aug 22, 2025
→ Notified: Feb 4, 2026
166d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 22, 2025 → Filed with AG: Feb 4, 2026	166d	90 days	ME AG >90d
Maine	Discovered: Aug 22, 2025 → Notified: Feb 4, 2026	166d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

New Hampshire State AGFeb 4 · first

Indiana State AGFeb 4 · first

Nebraska State AGFeb 4 · first

Massachusetts State AGFeb 4 · first

Vermont State AGFeb 4 · first

Washington State AGFeb 4 · first

Maine State AGFeb 4 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/ee90778a-e6bd-43d0-a5df-02439f5c8592.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 4, 2026
Raw hash: 3db5645044c11527d65210eac177c566029d9da0280953a8115e4199d7f7c10d

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityGravity Payments, Inc.

Victim entityGravity Payments, Inc.

Incidentdiscovered Aug 22, 2025

Stated responseSecured our systems

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov