Threat watch / Breach
Gnosis Pay: customer data exposed in its legacy card system
The crypto payment card provider says its monitoring detected unauthorised access on November 3 to the legacy system behind its Gnosis Pay-branded cards. Certain customer information was exposed; it says funds were not affected and its white-label platform was not touched.
- Sector
- Finance
- Way in
- Software flaw
- Product or vendor
- Gnosis Pay
- How it happened
- Unauthorised access to the legacy system powering Gnosis Pay-branded cards (its consumer line), already due for retirement on December 20. Gnosis Pay says it replaced the affected security credentials and "addressed the vulnerability", without naming it.[1][2] Checked 8 Nov 2026
- What was stolen
- "Certain customer information". Gnosis Pay emailed each affected customer the exact data taken but has not published a list. One customer, Rotki founder Lefteris Karapetsas, says his full name, home address, card number and linked wallet addresses were exposed.[1][2] Checked 8 Nov 2026
- Who was impacted
- Holders of Gnosis Pay-branded cards whose data was accessed; each was notified by email. The number of customers is not public.[1][2] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- Gnosis Pay's monitoring detects unauthorised access to the system powering its branded cards. Containment starts within two hours, it says. [1]
- Gnosis Pay discloses the breach, emails affected customers, makes 3D Secure mandatory for online card payments and says it is talking to data protection authorities and its card issuer. [1][2]