Gnosis Pay confirms customer data exposure in its legacy consumer-card system
Gnosis Pay confirms customer-information exposure after November 3 access to its legacy branded-card system. It says funds and its enterprise white-label platform were unaffected, affected customers were emailed, and online card payments now require 3D Secure. Public field categories, customer count and entry mechanism are not disclosed.
- Disclosed
- Nov 6, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Customers whose information was held in the legacy system powering Gnosis Pay-branded consumer cards; individual notices define exposure.
- Gnosis Pay · Data breach · Payments
- In the wild
- Yes
- Gnosis Pay confirms unauthorized consumer-card system access and customer data exposure.
What happened
The disclosure concerns customer information in the legacy consumer-card system. Gnosis Pay says its separate enterprise white-label card platform and user funds were unaffected. The public notice does not establish the exact fields, a victim total, confirmed fraudulent spending, stolen seed phrases or a wallet-draining attack. Ask about your own records; a customer’s public screenshot does not define every customer’s exposure.
The company says it notified every affected customer, replaced credentials and addressed the vulnerability; it is also reviewing the incident and arranging specialist misuse monitoring. These are vendor statements, not an independent audit or proof that copied data was recovered. L4 reflects confirmed customer-data exposure in a payment platform, with scale still unknown. This November event is separate from the June 2026 Zodiac-module funds exploit; do not import that event’s loss or wallet totals.
Crime-scene timeline
Nov 3, 2026
Monitoring detects unauthorized legacy-system access
The company says containment began within two hours of detection; affected credentials were subsequently replaced and the vulnerability addressed. This is not a claim that containment finished within two hours.
Nov 6, 2026
Gnosis Pay publishes disclosure and emails affected customers
The company reports increased card/wallet monitoring, mandatory 3D Secure for online card payments, partner notifications and communications with data authorities and its issuer.
Dec 20, 2026 (scheduled)
Existing consumer-system retirement remains planned
Additional safeguards are intended to remain until the previously planned retirement. The breach notice does not confirm completed closure or instruct users to transfer funds in response to messages.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Gnosis Pay original November 6 breach noticePrimaryConfirms November 3 access and customer-information exposure in the legacy B2C card system; containment began within two hours, credentials replaced/vulnerability addressed, funds and enterprise platform unaffected according to the company, notices and additional safeguards.