Gnosis Pay reports customer data breach before card service closure

The breach affected Gnosis Pay’s consumer business, which operates its branded cards, but not its enterprise platform for white-label card programs, the company said. Its monitoring systems detected unauthorized access on Nov. 3. Containment began within two hours, followed by the replacement of affected security credentials and a fix for the vulnerability. Gnosis Pay said it emailed each affected customer on Nov. 6 with details of information taken from their account. It did not disclose how many customers were affected or specify the categories of information exposed across accounts.

The company said it had notified partners and was communicating with relevant data protection authorities and its card issuer. It is reviewing the incident, applying lessons across its systems and arranging specialist monitoring for possible misuse of exposed information. Card activity and wallets are also under closer watch for fraud or attempts to access customer funds. Mandatory 3D Secure verification now applies to all online card payments and will remain in place until the consumer system is retired.

The disclosure prompted users to question the company’s response and warn about phishing and other threats. One user, posting as Zoodirektor, asked what Gnosis Pay meant by taking “full responsibility.” Another, dramanoodle, raised concerns about fraudulent messages and physical attacks targeting cryptocurrency holders. Gnosis Pay warned that suspicious messages could include genuine personal details or refer to real purchases. It advised customers to avoid links in unexpected communications and instead open the official web app or a partner app directly. The company said it and its partners would never ask for seed phrases, private keys, PINs or full card numbers, or tell customers to move funds by message or phone.

The planned closure was announced before the breach. A Sept. 21 notice set the end of branded card services for 23:59 UTC on Dec. 20, 2026. Physical and virtual cards will then stop authorizing transactions, while the web app will retain withdrawal functionality and customers will continue to own assets in their self-custodial Safe accounts. Customers seeking continued card access must join a partner program under new terms; the move is optional, but existing branded cards will stop working. Gnosis Pay also advised cardholders to export transaction histories and update recurring payments. General cardholder support is scheduled to end June 18, 2027; help with refunds, disputes and chargebacks will continue until June 12, 2028.

The breach follows a separate June exploit involving about $1.5 million in digital assets. In a July postmortem, Gnosis Pay attributed that incident to a flaw in the Zodiac smart contract framework and said affected customers had been fully reimbursed. The company has not said the two incidents share a cause. Customers affected by the latest breach can contact help@gnosispay.com; Gnosis Pay said its support team is prioritizing them.