Gnosis Pay discloses breach of legacy debit card system

Gnosis Pay has disclosed a data breach of the legacy system behind its self-branded debit cards, after detecting unauthorized access on Nov. 3. The company says customer funds were not affected and that it contained the incident within two hours.

The breach exposed certain customer information, though Gnosis Pay has not specified how many accounts were involved or what data fields were accessed. The company said it replaced compromised security credentials and remediated the vulnerability. Its enterprise platform, which powers white-label card programs for third parties, was untouched, according to the disclosure.

The gap matters. A two-hour containment claim is only as strong as the detection window that precedes it, and the company has not said when the attacker first gained access. Nor has it detailed the exposure in per-customer terms — identity documents, transaction histories or merely contact records each carry different fraud consequences.

What changes for cardholders?

Gnosis Pay has made 3D Secure verification mandatory for all online card payments. The requirement stays in force until Dec. 20, when the company retires the affected legacy system entirely.

That retirement date is the operative fact here. A payments company running a system it now describes as legacy was, until Nov. 3, still processing live cardholder data on it. The Dec. 20 decommissioning removes the immediate attack surface; it does not answer why the system remained in service beforehand.

Is this part of a wider pattern?

Crypto card providers increasingly depend on third-party infrastructure and aging systems, and the sector has produced a string of recent incidents:

• Based said an attacker accessed an internal dashboard used to manage its Visa card program on Oct. 5. Some customer data was exposed, but the attacker reportedly failed to reach deposited funds.
• Rain suffered a vulnerability in its Solana card infrastructure in August that allowed unauthorized withdrawals from card balances belonging to users of Tria and Avici.
• Revolut said an unauthorized third party used a fraudulent request from a legitimate government email domain to obtain sensitive customer information — potentially account statements, identity documents and Bitcoin transaction histories. Funds and systems were unaffected.

The common thread is not stolen crypto but leaked data. In three of these four cases the funds held up; the information around them did not. For cardholders, exposed identity documents and statements can enable downstream fraud long after the breach is contained.

What remains unverified?

Gnosis Pay's account is self-reported. The company has not published an independent forensic assessment, named the vulnerability class, or stated whether regulators in relevant jurisdictions — the card programs operate across European payments rails — have been notified.

The claim that white-label enterprise infrastructure was untouched also deserves scrutiny. If the legacy and enterprise systems shared credentials, vendors or code, the separation may be narrower than the disclosure implies. The company did not address this directly.

For customers, the practical takeaway is simple: enroll any second factor available, treat 3D Secure prompts as non-optional, and expect phishing attempts built from whatever data the attacker walked away with. For the industry, the takeaway is that card programs inherit the weaknesses of every layer beneath them — and legacy layers are the weakest of all.

The Dec. 20 retirement of the compromised system is the next verifiable milestone. Whether Gnosis Pay, Based, Rain or Revolut disclose further detail on scope or regulatory notification before then will indicate how seriously the sector treats data exposure short of fund loss.