Gnosis Pay Breach Exposed Card and Wallet Data on Nov. 3

Gnosis Pay said an unauthorized party accessed its consumer card system on Nov. 3, exposing full payment-card details and linked wallet addresses. The company did not disclose how many customers were affected or provide a total for the exposed records.

The exposed fields included card numbers, expiration dates and CVVs, together with customers’ names and home addresses. Some records also contained email addresses, phone numbers, nationalities and bank details, including IBAN and BIC information.

Gnosis Pay, a crypto payment card provider, canceled the affected cards on Nov. 3. The same-day action removed those card credentials from continued use through the provider’s consumer system, while the exposed data remained a separate misuse risk.

Card cancellation addressed the payment instrument directly, but the exposure extended beyond the canceled credentials. The disclosed personal fields could remain useful after Nov. 3 because the company did not say it could change names, addresses, nationalities or bank information.

How quickly did Gnosis Pay contain the breach?

Gnosis Pay said it began containing the incident within two hours of the unauthorized access. The company also replaced affected security credentials and fixed the vulnerability.

Those two hours are the only clear timing measure in the company’s statement. It gives no separate interval for investigation, card cancellation or customer notification, although affected cards were canceled on Nov. 3.

Were customer funds and business programs affected?

Gnosis Pay said customer funds and its separate business platform supporting white-label card programs were not affected. It also said it found “no suspicious transactions or fund transfers.”

That finding addresses financial activity observed by the company, not a guarantee against later misuse. Gnosis Pay did not report a financial loss figure.

The company’s business-platform statement narrows the reported scope to the consumer card system. It did not identify any compromised white-label card program.

What does the scale of the exposure mean for customers?

The phrase “some records” matters because it does not establish that every affected file contained every additional field. Combined with the undisclosed customer count, that language prevents a reliable calculation of how many people faced identity, card or banking-data exposure.

Gnosis Pay did not disclose the unauthorized party’s identity, the access method, the number of exposed files or a dollar value for the incident. Those gaps leave the scale and entry route unresolved even though the company said it had fixed the vulnerability.

How can the stolen information be misused?

The disclosed mix creates two operational risks: fraudulent use of complete card credentials and targeted phishing. Card numbers, expiration dates and CVVs can supply payment details for attempted transactions, while names and contact details can make a fraudulent approach appear legitimate.

Gnosis Pay urged customers to “watch for phishing attempts” that use personal or transaction information. The warning fits the disclosed fields, which join payment records with identity, contact and banking data rather than limiting the exposure to one credential.

The company said it was monitoring for possible misuse of the stolen data. It did not set a deadline for publishing an updated customer count or disclosing whether monitoring had identified misuse, leaving the incident’s endpoint unresolved.

What changed operationally?

Gnosis Pay’s disclosed response covered containment, credential replacement, vulnerability repair and card cancellation. Those steps addressed system access and active cards; they did not amount to a stated recall of information already copied by the unauthorized party.

The next material checkpoint would be an update from Gnosis Pay on customer numbers, fraudulent activity and any misuse of the exposed data. The company’s Nov. 3 statement set no deadline for that disclosure.