Gnosis Pay has confirmed that unauthorized access to its legacy consumer card system exposed customer information tied to its branded card program. The company said the breach affected its business-to-consumer infrastructure, while its enterprise platform for white-label card programs was not impacted.
According to the company, monitoring systems detected the intrusion on Nov. 3, 2026. Gnosis Pay said its security team began containment within two hours, replaced affected credentials, and fixed the vulnerability involved. It added that customer funds were not affected.
Breach tied to system already set for retirement
Gnosis Pay disclosed the incident on Nov. 6, three days after detecting the unauthorized access. In its update, the company said the breach was limited to the system powering Gnosis Pay-branded cards, a platform it said had already been scheduled for retirement on Dec. 20, 2026.
The company drew a distinction between that legacy B2C environment and its separate enterprise infrastructure. It said the platform used for white-label payment programs was not affected by the incident.
What information was exposed
Gnosis Pay has not published the number of customers affected and has not released a full public list of exposed data fields. Instead, it said affected cardholders received individual notices explaining which account records were accessed.
Based on those notices, exposed information included full names, residential addresses, card numbers, and cryptocurrency wallet addresses linked to affected accounts. One user publicly said his name, home address, card number and linked wallets were compromised.
Company response and new safeguards
After the breach, Gnosis Pay said it introduced mandatory 3D Secure verification for online card payments and increased monitoring for suspicious card and wallet activity. The company said those measures will stay in place until the consumer card system is retired in December.
Gnosis Pay also said it notified partners, its card issuer, and relevant data protection authorities. It said it is carrying out a broader security review and arranging specialist monitoring to identify any misuse of stolen information.
In its customer guidance, the company warned users to treat unexpected emails, texts, calls or letters about Gnosis Pay, partner apps or cards with caution, even if those messages contain genuine personal details or real purchase information. It also said legitimate representatives would never ask for seed phrases, private keys, PINs or full card numbers.
Privacy concerns and recent history
The disclosure prompted criticism from users online, including Rotki founder Lefteris Karapetsas, who said he was disappointed that his data had not been protected. Other replies to the company’s public post also reflected frustration over the breach.
The incident raises privacy concerns because the exposed records can connect identifiable individuals, including their home addresses, with publicly traceable blockchain wallet addresses. The available disclosures do not show that the stolen data has already been used for phishing, impersonation or other abuse, but Gnosis Pay said it is monitoring for signs of misuse.
The November breach follows a separate June 2026 incident involving Gnosis-related infrastructure that reportedly led to roughly $1.5 million to $1.8 million in losses, which Gnosis later covered. In the current case, the company says the immediate issue is exposure of personal information rather than loss of customer funds.
Next confirmed step
Gnosis Pay’s next confirmed operational step is the retirement of the affected consumer card system on Dec. 20, 2026. Until then, the company says added payment checks and heightened monitoring will remain in place while it continues its security review and communicates with affected customers.
Source: news.bitcoin.com