Gnosis Pay Discloses Customer Data Breach on Legacy Consumer Card System

Payment network Gnosis Pay disclosed an unauthorized intrusion into the infrastructure powering its consumer-facing debit cards on Nov. 6, leading to the exposure of customer information ¹. The incident, detected on Nov. 3, affected the platform's direct business-to-consumer card program ¹. The company stated that containment operations began within two hours of initial detection, during which engineers revoked compromised security credentials and patched the underlying vulnerability ¹.

No user funds were compromised during the incident, according to the project's official statement ¹. Furthermore, Gnosis Pay confirmed that its enterprise platform—which runs its white-label payment operations—remained insulated and was not impacted by the breach ¹. The compromised consumer system had previously been slated for complete retirement on Dec. 20 ¹.

Protective Measures and Regulator Notifications

To safeguard users prior to the full decommissioning date, Gnosis Pay has made 3D Secure verification compulsory for all online card transactions and expanded active monitoring of associated card activity and user wallets ¹. The provider confirmed it has notified its card issuer, shared incident details with relevant data protection authorities, and alerted each impacted customer via email regarding the specific data categories exposed ¹.

The security lapse highlights ongoing operational risks at the intersection of crypto payment systems and traditional payment processing infrastructure, arriving as broader market sentiment lingers in "Fear" at 28 with crypto market capitalization at $2.54 trillion at the time of writing. While digital asset protocols routinely secure base layer funds, off-chain infrastructure remains a vector for identity theft and social engineering campaigns ¹.

Gnosis Pay warned cardholders to remain vigilant against phishing attempts, text scams, and unauthorized inquiries requesting private keys, seed phrases, PINs, or funds ¹. The platform stated its heightened fraud monitoring protocols and mandatory 3D Secure controls will persist until the legacy system shuts down on Dec. 20 ¹.