Gnosis Pay discloses customer data breach on legacy system behind Gnosis Pay-branded cards; phishing risk for cardholders

Summary

On 6 November 2026 Gnosis Pay disclosed that on 3 November 2026 its monitoring detected unauthorised access to the system powering Gnosis Pay-branded cards (its B2C business line), resulting in the exposure of certain customer information. Containment began within two hours of detection; the company says it replaced the affected security credentials and addressed the vulnerability. Gnosis Pay states that funds were not affected.

Affected

• Legacy system powering Gnosis Pay-branded (B2C) cards, already scheduled for retirement on 20 December 2026
• Not affected (per Gnosis Pay): the enterprise platform powering its white-label card programmes
• Fixed: affected credentials replaced and vulnerability addressed (per Gnosis Pay); the specific data exposed per customer was communicated to affected customers by email

Impact

Exposure of customer personal information. Gnosis Pay has not publicly stated the number of affected customers or the data types involved. The company says funds were not affected. The main risk is targeted phishing or social engineering that uses real customer details or real purchases. Gnosis Pay has increased monitoring of card activity and wallets for fraud and made 3D Secure mandatory for all online card payments until the B2C system is retired.

Recommended actions

• Treat any unexpected email, text, call or letter about Gnosis Pay, a Partner App or your card as suspicious, even if it contains your real details; do not click its links and go to the official Gnosis Pay web app or your Partner App directly.
• Never share your seed phrase, private keys, PIN or full card number. Gnosis Pay says it and its Partner Apps will never ask for these, never ask you to re-verify identity by email or text, and never ask you to move funds by email, text or phone.
• Reject any 3D Secure prompt you did not initiate and review card transactions regularly.
• Be careful who you share your address or details of your crypto holdings with, online and offline.
• Follow any additional actions in the breach notification email Gnosis Pay sent to affected customers; contact help@gnosispay.com with concerns.

Source & attribution

This 0xCERT advisory summarises a disclosure by Gnosis Pay: https://gnosispay.com/blog/data-breach-legacy-system-gnosis-pay-branded-cards (corroborated by CryptoTicker: https://cryptoticker.io/en/gnosis-pay-data-breach/). Details may change; refer to the original source for the authoritative record.