Gnosis Pay breach exposes card details and personal data
Gnosis Pay says card and personal data were exposed
Gnosis Pay, a crypto-linked Visa debit card provider, disclosed a security breach on Friday. The breach exposed payment card details, home addresses and cryptocurrency wallet addresses. A wallet is a digital account tool that holds crypto assets.
The company said customer funds remained safe. It also said its separate enterprise platform was unaffected.
Main details at a glance
- Gnosis Pay detected unauthorized access on Nov. 3.
- It said it began containing the breach within two hours.
- Exposed data included full card numbers, expiration dates and CVV codes.
- The legacy consumer card system will be retired on Dec. 20.
- The company did not disclose how many customers were affected.
What Gnosis Pay said it did after detecting the breach
Gnosis Pay said it detected unauthorized access to its legacy consumer card system on Nov. 3. It said it began containing the breach within two hours.
The company said it replaced compromised security credentials and addressed the vulnerability. It made 3D Secure verification mandatory for online payments. 3D Secure is an extra check used to confirm online card payments. This step will remain in place until the legacy system is retired on Dec. 20.
Gnosis Pay also warned customers about phishing attempts that use personal or transaction details. Phishing means fake messages used to trick people into sharing information. The company said it was arranging monitoring for potential misuse of the stolen data.
Details from breach notices and outside data
Breach notifications reviewed by Cointelegraph listed exposed information including customer names, home addresses and wallet addresses linked to affected accounts. The data also included email addresses, phone numbers and nationalities. In some cases, it included banking details such as IBAN and BIC information.
One notification said the customer's card was canceled on Nov. 3. That notice said no suspicious transactions or movement of funds were detected.
According to OpenRate, a third-party platform tracking crypto card activity, Gnosis Pay had around 2,400 daily active cardholders. It processed $263,200 in transactions over the previous 24 hours, according to that data.
What is still unknown
Gnosis Pay did not disclose how many customers were affected. It did not immediately respond to Cointelegraph's request for comment.
Only one customer's notice was described as confirming a card cancellation with no suspicious transactions. The source material does not confirm that this result applied to all affected customers.
Why it matters for affected customers
The exposed data includes information that can be used for phishing and card fraud, such as full card numbers and CVV codes. The company warned customers about phishing attempts using personal or transaction details.
The source material says customer funds and the enterprise platform were unaffected. It does not provide the same confirmation for every individual customer account.
What happens next for the legacy system
Gnosis Pay said the legacy system is planned for retirement on Dec. 20. Until then, 3D Secure verification is mandatory for online payments.
The company said it was arranging monitoring for potential misuse of the stolen data. No further timeline for that monitoring was provided in the source material.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.