Gravity Payments Data Security Incident Notification

Gravity Payments, Inc. Return Mail Processing PO Box 999 Suwanee, GA 30024 [Dat e ] En gage me nt # [E ngage m en t Num b er] TAATADDTDTFDADFAAAFADFTFADFAATFADADTAATTAFTFADTFFDDFDDATADTTTAFDT 24 3 6179 *****************A UTO *A L L F O R AA D C 03 0 SA MPLE A. SA MPLE - L 01 AP T AB C 123 AN Y ST A NYTO WN, US 12345-6789 RE: No tice o f Data [Extra1] Dear Sa mp le A. Sa mpl e: Grav ity Pay ments, Inc. (“ Gravity ” or “w e”) is writing to info r m y o u o f a data sec ur ity in cide n t th at may h ave aff ec ted so me of y our pe rso nal info rm ation. Gravity is a credit card proc ess in g an d financial se r vic es co mpany, and we o b tained y o ur perso n al info rmation in th e co urse of the se rvic es w e prov ide. We want to prov ide y o u w ith de tails abo ut th e in cide nt and our resp onse to h elp y ou pr ote ct y ou r info r m ation fro m pos sible misu se, should y ou fe el it is appropriate to do so. What H appene d On or a r ound August 22, 2025, a th ir d-par ty serv ice pr ov ider in fo r med us tha t due to a vulnerability in th eir so ftw ar e an unkn ow n act or ga i n ed a ccess to cer ta i n fil es bel on gi n g t o G r a vit y s tor ed i n it s cust om er r el at i on sh i p m an a gem en t s oftwar e. Upon becom in g aw ar e of th is ac tiv ity, we immediate ly laun ched an in ve stigatio n to be tter understand the sc o pe an d impact o f the in cide n t w ith th e ass istance of thir d-party cy b erse curity e xperts to reme diate an d further in ve stigate what happened. Th e inve stigatio n dete r min ed th at an un a u th or i zed t h i r d pa r t y g ai n ed a ccess t o a l im i t ed n um ber of Gr a vi ty fi les. Gr a vi ty con d uct ed a t im e- in ten si ve r eview of t h e aff ected files to i den t i fy the personal i n fo rm ation contai n ed th erein. Th a t r evie w was co mpleted o n Janua ry 15, 2026, an d identified t h a t som e of y our per s on a l i n for m a t i on ma y h a ve be en a ffec t ed. At p r es en t, we h a ve n o evi d en ce t h a t an y of your per s on a l info r mation h as b ee n misuse d as a resu lt of this incide nt. What Info r mation Was Inv olv e d The impac ted perso nal info r mation r elating to y ou in clude s y our name and [Extra2]. What We Are Doing U pon disc o v ery o f th e in cide n t, we se cured our sy ste ms, perman ently rev oke d th e th ir d-party se r vic e pr ov ider’s acc es s to o ur data, and n otif ied law enfo r ce ment. We h ave no ev idenc e th at th ere is any o ngoing thr eat to our sy ste m or netw ork. We ar e also notif y in g y ou so that y o u may take f urther ste ps to prote ct y our in fo r mation should y ou fe el it appropriate to do so. We ar e prov iding y o u w ith acc es s to [Extra3] mo nth s o f cred it monito rin g an d ide ntity resto ration serv ice s thr oug h Expe rian, at n o char ge to y ou. Yo u must enroll within 90 day s from th e date of this lette r, [Date]. What You Can Do We enco ur age y o u to remain vigilant against incide nts of identity thef t an d fraud, to r ev iew y our acc ount state ments, an d to monitor y ou r c redit repo r ts fo r sus pic io us activ ity. Pleas e r ev iew the enclo se d “ Steps You Can Take to Hel p Pr otec t Your Information ”w h i c h de sc ribe s th e se rvic es we are o f f ering, h ow to ac tivate them, an d pr ov ides fu rth er de tails on h ow t o prote ct y ourse lf. For M or e I nf or ma ti on Pro tec tin g y o ur in fo r mation is impo rtan t to us. Ple ase be ass ured that we are co mmitted to helping y ou pr ote ct y our pe rso nal info r mation an d identity and ensu rin g th at y o ur info r mation is saf e an d sec ur e. We since r ely r egret any inco n ve n ience th is in cide nt m ay h ave caus ed y o u. If y ou have additio n al ques tio ns, y ou may call o ur dedic ated assistan ce li n e at 833-931-5050, Mo n day -Fr iday, from 8 a m to 8 pm Cen tr a l Ti me, or write to us at 110 N 27t h St, Bo ise, ID 83702. Si n cer el y, Grav ity P ay ments

How Do I Enroll for the Free Services? Free Credit Re port Under U.S. law, you are entitled to one free credit report annually from each of the three major credit reporting bureaus (Equi fax, Experian, and TransUnion). Obtain ing a copy of your credit report from each agency on an annual basis, and reviewing it for sus pici ous activity, can help you spot problems and addre ss them quickly. You can request your free credit report online at www.annualcreditrepo rt.com or by phone at 1-8 77-322-8228. You can also request your free cred it report by comp leting the reques t form at: www.annualcreditreport.com, and mailing it to Annual Credit Report Request Service, P. O. Box 105281, Atlanta, GA 30348 - 5281. You may wish t o stagger your requests so that you receive a free report by one of the three credit bureaus every four mon ths. Fra ud Alert As a precaution against i dentity th eft, you can consider placi ng a fraud alert on your credit file. A “fraud alert” tells credi tors to contact you before opening a new account or changi ng an existing account. A fra ud alert also lets your creditors know to wat ch for unus ual or suspicious activity. To place a fraud alert, call any one of the three major credit reporting age ncies listed below. An initial fraud alert remains effective for ninety days, and is free of charge. If yo u wish, you can renew the fraud alert at the expi ration of this initial period. As soon as one cre dit agency confirms your fraud alert, t he others are notified to place fra ud alerts on your file. Equifax ® P. O. Bo x 10 5069 At l an t a, G A 3 03 4 8- 5069 1-8 00- 685 -1111 https://www.equifax.com/personal/credit- report-services/credit-fraud-alerts Experian P. O. B ox 9554 Al l en, TX 75 0 13 - 9701 1-8 88- 397 -3742 www.experian.com/fraud/center.html TransUnion ® P. O. B ox 2000 Ch e st e r, P A 19 0 16 -1000 1-8 00- 680 -7289 https://www.transunion.com/fraud- alerts Sec ur ity Freeze Federal law also allows cons umers to place, lift or remove a security freeze on their credit reports at no charge. A security f reeze prohibits a credit reporting agency from releasing any information from a consumer’s credit repo rt without written aut horization. Be awar e that placing a security freeze on your credit repo rt may delay, interfere with, or prevent the timely approva l of any request s you m ake for new loans, credit mortga ges, employment, housi ng, or other se rvices. To place a security freeze on your cre dit report, you must send a written request by re gular, certified, or overnight mail at t he a ddresses below to each of the three major credit reporting age ncies: Equifax (www.equifa x.com); Experi an (www.experian.com); a nd TransUnion (www.transuni on.com). You ma y also request the security freeze through each of the credit reporting agencies’ websites or over the phone: Equifax ® P. O. Bo x 10 5069 At l an t a, G A 3 03 4 8- 5069 1-8 00- 685 -1111 https://www.equifax.com/personal/credit- report-services/credit-fraud-alerts Experian P. O. B ox 9554 Al l en, TX 75 0 13 - 9701 1-8 88- 397 -3742 www.experian.com/fraud/center.html TransUnion ® P. O. B ox 2000 Ch e st e r, P A 19 0 16 -1000 1-8 00- 680 -7289 https://www.transunion.com/fraud- alerts En gage me nt # [E nga gem ent Nu mb er] STEP S Y O U CAN TAKE TO H ELP PROTECT YO UR INFORMATION In r esp on se to t h e in ci den t, w e ar e pr ovi di n g you wit h acces s to Si n g le Bur eau Cr ed it Mon it or i n g/ Si n g l e Bu r ea u C r edi t R ep ort/Single B ureau Cr edit Sc ore serv ice s at n o charge. Th es e serv ices prov ide y ou with alerts fo r [Extra3] months fro m th e date of enr ollment when chan ges occ ur to yo ur cr edit f ile. T h is n otific ation is sent t o y ou th e sam e da y th at th e chan ge or updat e ta kes place w ith the b ureau. Finally, w e ar e pr ov idin g y ou w ith pr oac tiv e fraud assis tance to help with any ques tio ns that y o u might have o r in even t th a t y ou become a victi m of fr a u d. T h ese ser vi ces wil l be pr ovid ed by Ex per ia n sp ecia l i zi n g i n fr a ud a ssi st a n ce an d r em edi a ti on ser vi ces. T o e n r ol l i n C r ed i t M on i t or i n g ser vi ce s a t n o c h a r g e, pl e a s e l og on t o h t t p s: / / www. e x p er i a n i d wor k s. com / 1 Bc r e d i t a n d fol l ow t h e in str uctions prov ided. When pr ompted please pr ov ide t h e f ollo w in g unique co de to r ece i ve servic es: ABCDEFG HI In order fo r y ou t o r ecei ve th e mon i t or i n g ser vi ces d es cr i bed a bove, y ou m u st en r ol l wi t h i n 9 0 d a ys fr om t h e d a t e of t h i s let t er. Th e en r ol l m en t require s an internet co n n ectio n and e- mail acc o unt an d may n ot be availab le to m in ors un der the age o f 18 y ears of age. Ple ase note that w hen sig nin g up f o r mo nitoring se rvic es, y ou may b e aske d to ve rify perso n al info r mation f o r y ou r ow n prote ctio n to c o nfirm y ou r identity.

In order to request a security freeze, you will need to provide the following infor mat ion: 1. Your full name (including middle initial as well as Jr., Sr., II, III, et c.); 2. Social Security Numbe r; 3. Dat e of birth; 4. If you have m oved in the past five (5) years, provide the address es where you have lived over the prior five yea rs; 5. Proof of current address such as a current utility bill or telephone b ill; 6. A legible photocopy of a government i ssued identification card (state driv er’s license or ID card, military identification, etc.); 7. If you are a victim of identity theft, incl ude a copy of either the po lice report, investigative report, or complaint to a law enforcement agency concerning identity theft; an d 8. If you are not a victim of identity theft, incl ude payment by check, money orde r, or credit card (Visa, Ma sterCard, American Express or Discover only). Do not send cash through t he mail. The credit reporting agencies have three (3) business days after receiving your request to place a security freeze on your cred it report. The credit bureaus must also send written co nfirmation to you within five (5) business days and provide you with a unique perso nal identification number (PIN) or password, or both th at can be used by you to authorize the removal or lifting of the security fr eeze. To lift the security freeze in order to allow a specific e ntity or individual access to your credit report, you must call or se nd a written request to the credit reporting agencies by mail and include proper identification (name, address, and social security number) and the PIN number or password provided to you when you placed the security freeze as well as the identities of those entities or indiv i duals you would like to receive your credit report or the s pecific period of time you want t he credit report available. The credit re porting agencies have three (3) business days after receiving your re quest to lift the security freeze for those identified entities or for t he specified period of time. To remove the security freeze, you must send a written request to each of the three credit bur eaus by mail and include proper identification (name, address, and social s ecurity number) and the PIN number or password provided to you when you placed the s ecurity freeze. The credit bureaus ha ve three (3) business days a fter receiving your request to remove the security freeze. Additional I nf orm ati on You may obtain additional informatio n about identity th eft by contacting the above, your state Attorney General, or the Federal Trade Commission (FTC). The Federal Tra de Commission can be reac hed at: 600 Pennsylvania Avenue NW, Washington, DC 20580; www.identitytheft.gov; 1-877-ID-THEFT (1-877 -438-4338); and TTY: 1-866-653-4261. You are advi sed to report known or suspected identity theft to law enfor cement, including your state’s Attorn ey General and the FTC. Under th e law, you have the right to ob tain any police report filed in regard to this incident. If you are the victim of identity theft or fraud, you also ha ve the right to fi le a police report and obtain a copy of it. Notice was not delayed as a result of law enforcement. For Connecticut residents, t he Attorney General can be contacted at 165 Cap itol Avenue, Hartford, CT 06106, or (860) 808-5318. For District of Columbia residents, the Attorney Gene ral can be c ontacted at 400 6t h Street NW, Washingt on, D.C. 20001, oag.dc.gov, or (202) 727-34 00. For Indiana residents, the Attorne y General can be contacted at 302 W. Washin gton Street, 5th Floor, Indi anapolis, IN 46204, or (317) 232-6330. For Louisiana residents, the Attorney General can be contacted at 1885 North Third Street, Baton Rouge, LA 70802 P.O. Box 94005 Baton Rouge, LA 70 804, or (225) 326-60 79. For Maryland residents, the Attorney General can be cont acted at 200 St. Paul Place, 16th Floor, Baltimore, MD 21202, oag.state.md.us, or (888) 743-00 23. For Maine residents, the Attorney General can be contacted at 6 State House Station, Augusta, ME 04333, or (207) 626-8800. For Massachusetts residents, the Attorney General can be cont acted at 1 Ashburton Place, 20th Fl oor, Boston, MA 02108 (617) 727- 8400. For Montana residents, the Attorney Gener al can be conta cted at P.O. Box 201401, Helena, MT 59620-1401, or (406) 444-2026. For Nebraska residents, the Attorney Ge neral can be contacted at 1445 K Street, Room 2115 PO Box 98920 Lincoln, NE 68508, or (402) 471- 268 3. For New Hampshire residents, the Attorney General can be contacted at 1 Granite Place, So uth Conco rd, NH 03301, o r (603) 271- 3658. En gage me nt # [E nga gem ent Nu mb er]

For New Jersey residents, t he Attorney General can be contacted at PO Box 080, Trenton, NJ 08 625-0080, www.njo ag.gov, or (609) 984-5828. For New York residents, the Attorney General c an be contact ed at The Capitol, Albany, NY 12224, ag.ny. gov, or (800) 771-7755. For North Carolina reside nts, the Attorney General can be contacted at 9001 Ma il Service Center, Raleigh, NC 27699, NCdoj.gov, or (919) 716-6 000. For Oregon residents, the Attorney General can be contacted at 1162 Court St. NE, Salem, OR 97301-4096, www.doj.state.or.us, or (877) 877-9 392. For Vermont residents, the Attorney General can be contacted at 109 State Street, Montpelier, VT 05609, or (802) 828-3171. For Virginia residents, th e At to r ne y Ge n er al c an b e co n ta c te d a t 2 0 2 N 9 th S t, R ic h mo n d, V A 2 32 1 9 o r (80 4) 7 86 -2071. For Washington residents, the Attorney General can be c ontacted at 1125 Washi ngton St SE, PO Box 40100, Olympia, WA 98504, or (360) 753- 620 0. En gage me nt # [E nga gem ent Nu mb er]