Gnosis Pay Breach Exposed Customer Data, No User Count Published

Gnosis Pay said on Friday that someone had reached the system behind its own-branded debit cards. Customer information was exposed. Its monitoring caught the unauthorized access on 3 November, three days before the company published anything. The notice carries no number of affected customers and no list of what was taken. Each affected customer was emailed their own inventory instead. Funds were untouched, the company said, and the intrusion stopped at a consumer card system already due to be switched off on 20 December.

The company lists nothing, the notifications list a lot

"Certain customer information" is as specific as the blog post gets. The detail came out through customers posting their own emails. Those accounts do not agree. Cointelegraph, working from notifications it reviewed, reported full card numbers, expiry dates, CVV codes, names, home addresses, linked wallet addresses, email addresses, phone numbers, nationalities and in some cases IBAN and BIC details. The Defiant reported one notice listing a name, a home address, a full card number with its security code and every wallet address on the account. Protos alone reports that the exposure varied between customers. Its narrower example covers the name printed on the card, a shipping address and an account reference. Cryptopolitan said later that the company had not officially confirmed whether email addresses, phone numbers, card security codes or banking details were leaked. Gnosis Pay has named no category publicly.

No account reports a PIN. None reports identity-document images, and none reports masked card data; where card numbers appear, they appear in full. The notice tells customers never to share a PIN or a full card number, which is advice and not a disclosure.

Two hours, and whose wording that is

The company's wording is careful. "Containment began within two hours of detection," the notice said, and the affected credentials were then replaced. The Block wrote that Gnosis Pay contained the incident within two hours, which claims more than the company did. Cryptopolitan has it starting a containment process two hours later. Funds being unaffected is a company claim too, and Cryptopolitan says no independent confirmation of it exists.

"Be suspicious of any unexpected email, text, call or letter about Gnosis Pay, a Partner App or your card, even if it includes your real details or a real purchase," the notice said.

A shutdown date that was already fixed

3D Secure, an extra verification step a card issuer can demand, is now mandatory on every online Gnosis Pay card payment. It stays in force until the consumer system retires. That retirement answers nothing about the breach. The closure notice setting 20 December is dated 21 September, seven weeks before the unauthorized access. crypto.news puts the cut-off at 23:59 UTC that day. The enterprise platform behind the white-label card programs was untouched, by the company's account.

Card programs keep springing leaks

Four such incidents have crossed the wire in five weeks. Based said an attacker reached an internal dashboard running its Visa program on 5 October. In August, a flaw in Rain's Solana card infrastructure allowed unauthorized withdrawals from Tria and Avici users' card balances. Revolut handed customer records to a forged government request in September, and Chainalysis disclosed an exposure reaching all of its users this week. Gnosis Pay separately lost funds on 1 June to a flaw in two modules of the Zodiac framework. Its July post-mortem put the extraction at $1.5 million with $300,000 more left inaccessible; the security firm Verichains published about $265,000 for the same event. Those figures do not reconcile. The company has not said the two incidents are connected.

The count is what is missing. Six outlets have noted its absence, and the three figures in circulation measure something else: a tracker's 2,400 daily active cardholders, The Defiant's count of card accounts on Gnosis Chain, and the 5,281 wallets in the June post-mortem. Gnosis Pay says it has told its partners, its card issuer and data protection authorities. A home address paired with a wallet address does not expire when a card does. That is the part the 20 December switch-off will not close.