Gnosis Pay has revealed a customer data breach affecting the legacy system behind its branded payment cards, saying personal information was exposed but funds were not. The company disclosed the incident on Nov. 6 and said it would keep extra security measures in place until the consumer card program is retired in December. What happened - Gnosis Pay’s security monitoring detected unauthorized access on Nov. 3. The team began containment within two hours, replaced affected credentials and patched the vulnerability. - The intrusion impacted the consumer business that runs Gnosis Pay–branded cards (B2C). The enterprise platform that powers white‑label card programs for partners was not affected. - Affected customers were emailed on Nov. 6 with account‑specific details about what was taken. Gnosis Pay did not disclose how many customers were affected or the exact categories of customer data exposed. - The company says it has informed its card issuer, partners, and the relevant data protection authorities. Customer protections and guidance - Gnosis Pay says funds were not compromised, but stressed that protecting personal data is equally important. - The firm is conducting a full review, applying lessons across systems and and arranging specialist monitoring for signs of misuse of the exposed information. - Card activity and wallets are under enhanced monitoring for fraud or unauthorized access. 3D Secure (an extra verification step for online purchases) has been made mandatory for all online card payments. - These safeguards will remain in place until the consumer system is retired at 23:59 UTC on Dec. 20, 2026 — a retirement date the company announced on Sept. 21 and which predates this breach. - Guidance issued to customers warns that follow‑up phishing attempts may include genuine personal details or references to legitimate purchases. Users are advised: - Not to click links in unexpected emails, texts, calls or letters about Gnosis Pay, partner apps or cards. - To open the official web or partner apps directly. - That neither Gnosis Pay nor partners will request seed phrases, private keys, PINs, full card numbers, or ask customers to re‑verify identity via email/text or ask them to move funds by message or phone. Service wind‑down and options - Physical and virtual cards will stop authorizing transactions after the Dec. 20, 2026 retirement time. The web app will retain withdrawal functionality, and assets remain owned by customers in their self‑custodial Safe accounts. - Customers wanting continued card access may opt into partner programs under new terms; moving is optional but existing branded cards will stop working regardless. - Cardholders were asked to export transaction histories and update recurring payments. General cardholder support is scheduled to end on June 18, 2027, while support for refunds, disputes and chargebacks will continue until June 12, 2028. Community reaction and context - Some users questioned whether an apology was sufficient and called for the service to be shut down immediately. Others warned the exposed data could fuel phishing or even physical attacks on crypto holders. - This disclosure follows a separate June incident in which about $1.5 million in digital assets was exploited. In a July postmortem, Gnosis Pay attributed that earlier incident to a flaw in the Zodiac smart contract framework and said affected customers were reimbursed. The company has not said the two incidents are related. Support - Affected customers received account‑specific recommendations and prioritized support. Anyone with concerns was directed to [email protected]. Read more AI-generated news on: https://app.chaingpt.org/news