Gravity Payments Data Breach Exposes Sensitive Information of Over 2,200 Individuals Gravity Payments, a Seattle-based financial services provider specializing in credit card processing and small business solutions, disclosed a data breach affecting 2,278 individuals. The incident stemmed from a vulnerability in third-party software, which an unknown actor exploited to access files stored in the company’s customer relationship management system. The breach was first detected on August 22, 2025, when a third-party service provider alerted Gravity Payments to the security flaw. An investigation, conducted with cybersecurity experts, confirmed unauthorized access to a limited set of files. A full review concluded on January 15, 2026, revealing that exposed data included names, Social Security numbers, and other personally identifiable information (PII), though specific details beyond these categories remain undisclosed. Gravity Payments reported the incident to the attorneys general offices of Maine and Vermont, with 14 affected individuals in Maine and four in New Hampshire. The company has begun notifying impacted customers and is offering free credit monitoring and identity restoration services through Experian for those who enroll within 90 days of receiving a notification. Affected individuals may also be eligible for compensation, as law firm Shamis & Gentile P.A. is investigating potential legal claims related to the breach. Gravity Payments has established a dedicated assistance line (833-931-5050) for further inquiries.

Gravity Payments Faces Class Action Over 2025 Data Breach On February 12, 2026, Gravity Payments a credit card processing company was hit with a proposed class action lawsuit in the U.S. District Court for the Western District of Washington. The suit, filed by a Tennessee resident, alleges the company failed to adequately protect customer data during a 2025 cyberattack that exposed the personal information of over 2,000 individuals. The plaintiff claims Gravity Payments’ negligence led to the breach, though specific details about the attack’s methodology or the compromised data remain undisclosed. The case seeks to represent all affected individuals, highlighting growing legal scrutiny over corporate cybersecurity failures. The incident underscores the financial and reputational risks businesses face following data breaches, particularly in the payments industry, where sensitive financial information is routinely handled. The lawsuit is pending in Seattle federal court.