Gnosis Pay has disclosed a data breach in the legacy system behind its branded consumer cards, saying unauthorized access exposed certain customer information. The company detected the intrusion on November 3 and announced it on November 6 after notifying affected customers. It said customer funds were not affected.

Consumer system was isolated

The incident was limited to Gnosis Pay's business-to-consumer card platform. The company's separate enterprise system, which supports white-label card programs for wallets, fintech companies and other partners, was not affected, according to the disclosure. That distinction narrows the confirmed scope, although Gnosis Pay has not published the number of customers involved.

Related reporting: BTCPay Links Hot-Wallet Sweeps to Servers on Version 2.4.1 or Older

Gnosis Pay said its security team started containment within two hours of detection, replaced the affected security credentials and addressed the vulnerability. It also increased monitoring of card activity and wallets for fraud or attempts to reach user funds. The company did not publicly identify the intruder or describe the technical path used to gain access.

Extra checks through December

All online payments on Gnosis Pay-branded cards now require 3D Secure, an additional verification step. The measure will remain in place until December 20, when the consumer system is due to close. That shutdown had already been scheduled as Gnosis Pay shifts its focus from a direct consumer card toward partner-operated programs.

The company said it emailed every affected customer with the specific information taken from that account. Its public notice did not provide a complete list of exposed data categories, meaning the risk may differ among customers. Gnosis Pay said it reported the breach to partners and is communicating with relevant data-protection authorities and its card issuer.

Mandatory 3D Secure can add friction to unauthorized online purchases, but it does not reverse the exposure of personal information. Customers therefore face two separate tasks: protecting payment activity during the remaining life of the card program and treating any unexpected contact as potentially fraudulent. The individualized email, rather than a social-media summary or forwarded message, is the relevant record of what each account lost.

Phishing risk becomes immediate

Personal details can make fraudulent messages more convincing even when no funds were directly stolen. Gnosis Pay advised customers to distrust unexpected emails, texts, calls or letters about their card, including messages that contain real personal details or refer to an actual purchase. Customers should open the official web app or a partner app directly instead of following links in unsolicited messages.

The company said it and its partners will never request a seed phrase, private key, PIN or full card number, and will not ask customers to move funds by email, text or phone. It also urged users to limit public sharing of home addresses and information about crypto holdings. Anyone who received a notification should follow the account-specific steps in that email and monitor card and wallet activity for anything unfamiliar.

What remains unknown

The scale of the breach, the full range of exposed information and the method of entry remain undisclosed. Gnosis Pay said it is carrying out a broader review and arranging specialist monitoring for signs that the data is misused. Those findings, and any response from data-protection authorities or the card issuer, will determine whether the incident produces further safeguards before the consumer platform is retired.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.