Gnosis Pay has disclosed a data breach affecting the legacy system behind its branded consumer cards, saying unauthorized access exposed certain customer information.
The company said its monitoring systems detected the activity on November 3 and that its enterprise platform for white-label card programs was not affected. The incident was disclosed in a statement published on November 6.
The company said its security team responded immediately and began containing the incident within two hours of detection. It later replaced the affected security credentials and addressed the vulnerability. Gnosis Pay has not publicly disclosed how many customers were affected or listed the categories of information accessed, but said it emailed every affected customer with details specific to their account. The company’s limited public disclosure is similar to Bithumb’s October data breach, where the exact types of exposed customer information were also not disclosed.
Gnosis Pay said customer funds were not affected and the breach was confined to the system powering its consumer card business. The company has made 3D Secure verification mandatory for all online card payments and increased monitoring of card activity and wallets. Those measures are expected to remain until the affected system is retired on December 20, 2026, a shutdown date that had already been planned before the breach.
The company said it had reported the incident to its partners and was communicating with the relevant data protection authorities and its card issuer. It is also conducting a review and arranging specialist monitoring for signs that the exposed information is being misused.
Gnosis Pay warned that suspicious emails, text messages, calls or letters could include real customer details or purchase information. It said neither the company nor its partner apps would ask customers for seed phrases, private keys, PINs or full card numbers. A similar distinction between exposed personal information and wallet credentials appeared in Keystone’s October customer-data breach, which exposed names and shipping addresses but not wallet recovery phrases or private keys.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
