The Gnosis Pay data breach exposed customer information in the legacy system behind its branded consumer debit cards, according to the company. Gnosis Pay says funds were not affected, but it has added mandatory verification for online card payments and warned customers about convincing impersonation messages.
Its November 6 disclosure dates the detection of unauthorized access to November 3. The important distinction for cardholders is between money remaining unaffected, as the operator reports, and personal information remaining private. The company acknowledges the latter was compromised.
What information was exposed in the Gnosis Pay data breach?
The official incident notice describes the exposure as “certain customer information.” It does not publish a complete list of affected data fields or a customer count. That means the public disclosure alone cannot tell an individual cardholder exactly which of their details were taken.
Gnosis Pay says every affected customer received an email explaining what information was taken from their account and recommending actions relevant to that exposure. The company says containment began within two hours of detection, affected security credentials were replaced and the vulnerability was addressed. It has not publicly identified the attacker or explained the vulnerability in detail.
Were Gnosis Pay funds or enterprise cards affected?
Gnosis Pay says funds were unaffected and the incident was limited to the legacy system powering its branded B2C, or consumer, cards. It says its enterprise platform, which supports white-label card programs, was not affected. These statements describe the operator’s findings; the reviewed disclosure does not supply an independent forensic or balance audit.
The incident should therefore not be presented as established evidence of drained customer wallets or a compromise of every Gnosis Pay card program. At the same time, the absence of reported fund losses does not erase the privacy risk from exposed information. Someone using genuine account or purchase details can make an unsolicited message appear more credible.
What changed for online card payments?
The company says it made 3D Secure, an extra verification step, mandatory for online card payments and increased monitoring of card activity and wallets. It says these measures will remain until the branded-card B2C system is retired on December 20, 2026.
That retirement was already planned. Crypto.news’s November 6 coverage notes that the closure had been announced before the breach. December 20 is therefore not a newly imposed shutdown date caused by this incident; it is the existing endpoint for the legacy system and the additional safeguards described in the notice.
What should affected cardholders check?
Gnosis Pay advises customers to treat unexpected emails, texts, calls or letters cautiously—even when they contain real personal details or a genuine purchase. Its guidance is to open the official Gnosis Pay web app or a partner app directly rather than follow links in an unsolicited message.
The company says it and its partner apps will not ask customers to disclose a seed phrase, private keys, PIN or full card number, or tell them to move funds through an email, text or phone call. Requests to “re-verify” an identity through those channels should not be mistaken for the account-specific recommendations the company says it has sent.
For an affected cardholder, the useful next step is to check their own incident information through a trusted channel and follow the recommendations tied to the data involved. The public notice cannot establish that every customer had the same exposure, and neither the disclosure nor the reviewed reporting proves that follow-on fraud has occurred.
