Gnosis Pay discloses a breach of its legacy card system

Gnosis Pay disclosed on 6 November that unauthorised access detected on 3 November exposed customer information in its own-branded card system. The company says funds and its enterprise white-label platform were unaffected.

Containment began within two hours of detection, according to the company; that is not a claim that the entire investigation finished in two hours. Gnosis Pay says it subsequently replaced affected credentials and fixed the vulnerability. The affected system was already scheduled to retire on 20 December.

The company says it emailed affected customers with account-specific details and made 3D Secure verification mandatory for online card payments. Its public notice does not give a customer count or a complete list of the information exposed.

For affected cardholders, the notice's immediate advice is to reach the official app directly rather than follow unsolicited messages, even when they contain genuine personal or purchase details. It says customers will not be asked by message or phone to move funds or disclose wallet secrets. The reported absence of a funds loss does not erase the exposure of personal information.