Gnosis Pay disclosed on Friday that a security breach exposed customers’ payment card details, home addresses and cryptocurrency wallet addresses. The crypto-linked Visa debit card provider confirmed the incident affected its legacy consumer card system but stated that customer funds were not compromised.
The company detected unauthorized access to the legacy system on Nov. 3 and began containing the breach within two hours, according to a statement from Gnosis Pay. While the firm did not disclose the total number of affected customers, breach notifications reviewed by Cointelegraph identified the specific types of data exposed.
Exposed data and immediate response
The compromised information included full payment card numbers, expiration dates, CVV codes, customer names, home addresses and wallet addresses linked to affected accounts. The data set also contained email addresses, phone numbers, nationalities and, in some cases, banking details such as IBAN and BIC information.
One notification shared by user Lefteris Karapetsas confirmed that his card was canceled on Nov. 3, with no suspicious transactions or movement of funds detected at the time. Gnosis Pay said it has replaced compromised security credentials and addressed the underlying vulnerability.
To mitigate further risk, the provider made 3D Secure verification mandatory for all online payments. This measure will remain in place until the legacy system’s planned retirement on Dec. 20. Gnosis Pay also warned customers to be vigilant against phishing attempts using their personal or transaction details and said it was arranging monitoring for potential misuse of the stolen data.
Scope of operations
Gnosis Pay clarified that its separate enterprise platform, which powers white-label card programs, was unaffected by the breach. The company did not immediately respond to a request for comment regarding the total number of users impacted.
Data from OpenRate, a third-party platform tracking crypto card activity, indicates Gnosis Pay had approximately 2,400 daily active cardholders and processed $263,200 in transactions over the previous 24 hours prior to the disclosure.
