Gravity Payments Data Breach: Third-Party CRM Vulnerability Exposes Customer Information

A credit card processing company has notified over 2,200 individuals that their personal information was compromised after an unauthorized actor exploited a vulnerability in third-party software, highlighting the persistent risks that vendor relationships pose to financial services firms.

Gravity Payments, Inc., a Boise-based payment processor and financial services company, disclosed the breach to the Maine Attorney General's Office on February 4, 2026. The incident underscores how financial institutions remain vulnerable even when their own systems are secure—a single weak link in the vendor chain can expose sensitive customer data.

Timeline of Events

The breach timeline reveals the extended periods that often characterize third-party security incidents:

• August 22, 2025: A third-party service provider notifies Gravity Payments that a vulnerability in their software allowed an unknown actor to access certain Gravity files stored in the provider's customer relationship management (CRM) system.
• August-January 2025-2026: Gravity launches an investigation with third-party cybersecurity experts to determine scope and impact.
• January 15, 2026: The review of affected files is completed, confirming that personal information was exposed.
• February 4, 2026: Gravity Payments files notice with the Maine Attorney General and begins notifying affected individuals.

The five-month gap between initial discovery and completion of the file review reflects the complex, time-intensive nature of forensic investigations—particularly when third-party systems are involved. Organizations often face significant challenges in obtaining complete information from vendors and conducting thorough data mapping to identify all affected individuals.

Data Exposed

According to the notification letter, the compromised information includes names and additional personal data that varies by individual (indicated by placeholder fields in the template notification). While the specific data types are not enumerated in the public filing, payment processors typically handle sensitive financial information including:

• Social Security numbers
• Bank account details
• Payment card information
• Transaction histories
• Contact information

The notification indicates that Gravity is offering affected individuals between one and several months of credit monitoring and identity restoration services through Experian, suggesting the exposed data extends beyond basic contact information to include identity-sensitive details.

Attack Vector Analysis

The breach originated from a vulnerability in third-party CRM software—a common attack surface that has plagued the financial services sector. CRM platforms, by design, aggregate customer data to facilitate relationship management and sales processes. This concentration of data makes them attractive targets for threat actors.

Key technical details from the notification:

• Vector: Software vulnerability in third-party CRM platform
• Access Method: Unknown actor exploited the vulnerability to access files
• Scope: Limited number of Gravity files stored in the vendor's system
• Response: Gravity permanently revoked the third-party provider's access to data

The company's decision to permanently sever the vendor's data access—rather than simply patching and continuing the relationship—suggests either significant concerns about the vendor's security posture or a broader reevaluation of third-party risk.

Impact Assessment

With 2,278 individuals affected, this breach falls on the smaller end of financial services incidents. However, the nature of the data—processed by a payment company—could enable various forms of fraud:

Immediate Risks:

• Identity theft using exposed personal information
• Account takeover attempts leveraging compromised credentials
• Targeted phishing campaigns using legitimate company details

Business Impact for Gravity:

• Notification and remediation costs (credit monitoring, legal, forensics)
• Potential regulatory scrutiny as a financial services provider
• Reputational considerations in a trust-dependent industry

Gravity stated it has "no evidence that any personal information has been misused" as a result of the incident—standard language that provides limited assurance given the months between unauthorized access and breach discovery.

Regulatory Implications

Payment processors operate in a heavily regulated environment with overlapping compliance obligations:

PCI DSS Requirements: As a credit card processor, Gravity Payments must comply with Payment Card Industry Data Security Standard requirements. PCI DSS 4.0, which became mandatory in March 2025, includes enhanced requirements for third-party service provider management under Requirement 12.8, including maintaining contracts that require vendors to demonstrate their own PCI compliance.

State Breach Notification Laws: The Maine filing triggers the 50-state patchwork of breach notification requirements. The varying notification windows and data type thresholds across jurisdictions create significant compliance complexity for organizations handling customer data nationally.

GLBA Safeguards Rule: Financial institutions must implement comprehensive information security programs that address vendor management. The FTC's updated Safeguards Rule, which took full effect in 2023, requires covered entities to oversee service providers' security practices.

Potential Enforcement Considerations: Regulators increasingly focus on third-party risk management failures. The incident could draw attention if investigators determine that Gravity's vendor oversight practices were inadequate—though the company's swift response and remediation efforts may mitigate such concerns.

Lessons for the Financial Services Industry

This breach offers several takeaways for payment processors and financial institutions managing complex vendor ecosystems:

1. CRM Platforms Require Elevated Scrutiny

Customer relationship management systems often fly under the security radar compared to core banking and payment systems. Yet CRMs frequently contain sufficient personal information to enable identity theft. Financial institutions should:

• Classify CRM platforms as high-risk systems requiring enhanced security controls
• Implement data minimization policies limiting what information flows to CRM systems
• Conduct regular security assessments of CRM vendors

2. Vendor Access Should Follow Least Privilege

The notification states Gravity "permanently revoked the third-party service provider's access to our data." This raises questions about whether the vendor's original access level was appropriately scoped. Organizations should regularly audit vendor access permissions and question whether ongoing access remains necessary.

3. Detection Gaps Extend Incident Timelines

The breach was discovered because the vendor notified Gravity—not through internal monitoring. Organizations should implement:

• Anomaly detection for data access patterns on third-party platforms
• Contractual requirements for vendors to report security incidents within defined timeframes
• Log aggregation from critical vendor systems where technically feasible

4. Incident Response Plans Must Address Third-Party Scenarios

Third-party breaches present unique investigation challenges: limited access to forensic data, dependence on vendor cooperation, and complex contractual negotiations. Financial institutions should develop specific runbooks for vendor security incidents and test them through tabletop exercises.

The Broader Third-Party Risk Landscape

The Gravity Payments incident arrives amid a sustained wave of third-party breaches affecting financial services. The sector's interconnected nature—with payment processors, core banking providers, data aggregators, and specialized software vendors all exchanging sensitive data—creates systemic vulnerability.

Recent regulatory guidance from the OCC, FDIC, and Federal Reserve has emphasized third-party risk management, with examiners increasingly focusing on how institutions assess and monitor vendor security practices. The challenge for smaller financial services firms like Gravity Payments is implementing enterprise-grade vendor management programs with limited resources.

For the 2,278 individuals affected by this breach, the incident serves as another reminder that their data security depends not only on the companies they do business with directly, but on the often-invisible network of vendors and service providers operating behind the scenes.

Affected individuals can contact Gravity Payments' dedicated assistance line at 833-931-5050, Monday through Friday, 8 AM to 8 PM Central Time. Those who received notification letters have 90 days from the letter date to enroll in the complimentary credit monitoring services.