Gnosis Pay Breach Exposes Card, Personal and Wallet Data

Gnosis Pay disclosed a security breach affecting customers of its legacy consumer card system, a crypto-linked Visa debit card service. The company said customer funds remained safe and that its separate enterprise platform, which powers white-label card programs, was unaffected.

According to breach notifications reviewed by Cointelegraph, the exposed information included full payment card numbers, expiration dates, CVV codes, customer names, home addresses and cryptocurrency wallet addresses linked to affected accounts. The compromised data also included email addresses, phone numbers and nationalities. In some cases, banking details such as IBAN and BIC information were exposed.

Gnosis Pay detected unauthorized access on Nov. 3 and said it contained the incident within two hours. The company replaced compromised security credentials, addressed the vulnerability and made 3D Secure verification mandatory for online payments until the legacy system’s planned retirement on Dec. 20. One customer said their card was canceled on Nov. 3, with no suspicious transactions or movement of funds detected.

Gnosis Pay warned customers about phishing attempts that could use their personal or transaction data and said it was arranging monitoring for potential misuse of the stolen information. OpenRate data cited by Cointelegraph showed roughly 2,400 daily active cardholders and $263,200 in transactions over the preceding 24 hours. The company did not disclose how many customers were affected and did not immediately respond to Cointelegraph’s request for comment.