Gnosis Pay disclosed a customer data breach on Nov. 6 affecting the legacy system behind its branded payment cards, saying funds were unaffected and extra security checks would remain in place until the platform’s planned December closure.
Summary
- Unauthorized access was detected Nov. 3, with containment beginning within two hours, according to Gnosis Pay.
- Affected customers received individual emails explaining what information had been taken from their accounts.
- Mandatory 3D Secure checks now apply to all online card payments until the consumer system closes.
- Users questioned the company’s response and raised concerns about phishing following the exposure of personal information.
According to Gnosis Pay’s disclosure, the intrusion affected its consumer business, which operates Gnosis Pay-branded cards. Its enterprise platform, used to power white-label card programs for other businesses, was not affected.
The company said its security team responded immediately after monitoring systems detected unauthorized access on Nov. 3. Containment began within two hours, followed by the replacement of affected security credentials and a fix for the vulnerability.
Gnosis Pay adds payment checks after customer information exposure
Every affected customer was emailed on Nov. 6 with details of the information taken from their account, the company said. Its public statement did not give a customer count or list the categories of information exposed across the affected accounts.
Gnosis Pay said it had reported the breach to its partners and was communicating with the applicable data protection authorities and its card issuer.
While the company said funds were unaffected, it acknowledged that protecting personal information was equally important. It is carrying out a full review, applying lessons across its systems and arranging specialist monitoring for signs that the exposed information is being misused.
Card activity and wallets are receiving closer monitoring for fraud or attempts to access customer funds. Gnosis Pay has made 3D Secure, an extra verification step for online purchases, mandatory for all online card payments.
The company said the safeguards would remain until the consumer system is retired on Dec. 20.
Users challenge the response and raise phishing concerns
Replies to the company’s announcement questioned what accepting responsibility would mean for affected customers. Several users challenged whether an apology was enough, while others called for the service to shut down immediately.
One respondent, posting as Zoodirektor, asked: “What means ‘you take full responsibility’?” Another, posting as dramanoodle, raised concerns about further fraudulent emails and physical attacks targeting cryptocurrency holders.
The replies show concerns about the exposure of personal information despite the company’s assurance that funds were unaffected. Gnosis Pay’s own customer guidance warned that suspicious messages could contain genuine personal details or refer to a real purchase.
Customers were told to avoid links in unexpected emails, texts, calls or letters concerning Gnosis Pay, partner applications or their cards. The company advised opening the official web app or partner app directly.
It said neither Gnosis Pay nor its partners would request seed phrases, private keys, PINs or full card numbers. They would not ask customers to verify their identity again through email or text, or instruct them to move funds through messages or phone calls.
December closure was announced before the breach
The retirement date predates the November incident. A formal notice issued Sept. 21 set the end of branded card services for 23:59 UTC on Dec. 20, 2026.
Physical and virtual cards will stop authorizing transactions at that time. The web app will retain withdrawal functionality, and customers will continue to own the assets held in their self-custodial Safe accounts, according to the notice.
Customers who want continued card access must join a partner program under new terms. Moving is optional, but existing branded cards will stop working regardless.
The notice asks cardholders to export transaction histories before the closure and update recurring payments with merchants. General cardholder support is scheduled to end June 18, 2027, while support for refunds, disputes, and chargebacks continues until June 12, 2028.
Earlier $1.5 million exploit affected card infrastructure
The disclosure follows a separate June card-account exploit, previously covered by crypto.news, involving about $1.5 million in digital assets.
In its July postmortem, Gnosis Pay attributed that incident to a flaw in the Zodiac smart contract framework and said affected customers had been fully reimbursed. The November disclosure concerns customer information; the company has not stated that the incidents share a cause.
Customers affected by the latest breach have received account-specific recommendations. Gnosis Pay directed anyone with concerns to [email protected] and said its support team was prioritizing those directly affected.
