Gnosis Pay Reports Data Breach Ahead of Dec. 20 Card Shutdown

BitcoinWorldGnosis Pay reports data breach ahead of Dec. 20 card shutdown
Gnosis Pay disclosed on Nov. 6, 2026 that unauthorized access to the legacy system behind its branded payment cards exposed customer information, with monitoring systems flagging the intrusion on Nov. 3. The company said funds were not affected and that extra verification would remain in place until the consumer platform is retired at 23:59 UTC on Dec. 20, 2026, Crypto.news reported.
Gnosis Pay said hackers accessed customer information through its legacy B2C card system, not customer funds. The consumer platform was already scheduled to close on Dec. 20, 2026, and 3D Secure is now mandatory for all online card payments until then. Key facts
Gnosis Pay detected unauthorized access on Nov. 3 and began containment within two hours, according to its disclosure.
Every affected customer was emailed on Nov. 6 with details of the information taken from their account; the company did not publish a customer count.
The enterprise platform powering white-label card programs for other businesses was not affected.
3D Secure is now mandatory for all online card payments until the consumer system closes.
The retirement date predates the incident: a formal notice issued Sept. 21 set the end of branded card services for Dec. 20, 2026.
What the breach exposed, and where accounts differ
The company’s public statement did not list the categories of information exposed. Cointelegraph, citing breach notifications it reviewed, reported that the exposed data included full payment card numbers, expiration dates, CVV codes, customer names, home addresses, and wallet addresses, along with email addresses, phone numbers, nationalities and in some cases banking details such as IBAN and BIC information. One notification, per Cointelegraph, confirmed the customer’s card was canceled on Nov. 3 with no suspicious transactions detected.
Gnosis Pay said it replaced compromised security credentials and fixed the vulnerability, reported the breach to partners and its card issuer, and was in contact with applicable data protection authorities. It also said it is arranging specialist monitoring for signs that the exposed information is being misused, with closer fraud monitoring on card activity and wallets.
A closure that was already in motion
The shutdown was planned before November. According to the September notice, physical and virtual cards will stop authorizing transactions on Dec. 20, 2026. The web app will keep withdrawal functionality, and customers retain ownership of assets held in self-custodial Safe accounts. Cardholders who want continued card access must join a partner program under new terms; existing branded cards stop working regardless. The notice asks users to export transaction histories before the closure and update recurring payments with merchants. General cardholder support is scheduled to end June 18, 2027, while support for refunds, disputes and chargebacks continues until June 12, 2028.
The disclosure follows a separate June exploit involving about $1.5 million in digital assets, which Gnosis Pay’s July postmortem attributed to a flaw in the Zodiac smart contract framework and said affected customers had been fully reimbursed. The company has not stated that the two incidents share a cause.
Users push back as phishing fears grow
Replies to the company’s announcement questioned what accepting responsibility means in practice. One user posting as Zoodirektor asked what “you take full responsibility” means, while another, dramanoodle, warned of further fraudulent emails and physical attacks on cryptocurrency holders. Decrypt reported that Gnosis Pay urged customers to be cautious about sharing their address or details of their crypto holdings, online and offline — a warning that tracks with a rise in so-called wrench attacks. According to blockchain analytics firm Chainalysis, cited by Decrypt, more than $30 million was stolen in such attacks in the first half of 2026, putting the year on pace for a record.
Gnosis Pay’s guidance warned that suspicious messages could contain genuine personal details or refer to a real purchase. Customers were told to avoid links in unexpected emails, texts, calls or letters about Gnosis Pay, partner applications or their cards, and to open the official web app or partner app directly. The company said neither it nor its partners will request seed phrases, private keys, PINs or full card numbers, ask customers to re-verify identity by email or text, or instruct them to move funds through messages or calls. Anyone with concerns was directed to contact the company’s support address, with its team prioritizing those directly affected.
Why it matters
Crypto-linked cards sit at the intersection of self-custody wallets and traditional payment rails, so a breach that touches card credentials, home addresses and wallet links raises risks that go beyond a single account. Exposed card numbers can be canceled and reissued; exposed addresses and wallet associations cannot. The timing sharpens the problem for users: the product is winding down, but the personal data tied to it is not, and phishing attempts can reference real purchases or details to appear convincing. Gnosis Pay also sits among a cluster of recent industry security incidents, with Decrypt noting that Coinbase said last week a breach at analytics vendor Amplitude exposed some customer contact data, and that Ledger said confirmed cases in a suspected $87 million drain involved devices bought from a Southeast Asian reseller. Cointelegraph, citing third-party tracker OpenRate, put Gnosis Pay at roughly 2,400 daily active cardholders processing $263,200 over the prior 24 hours — a reminder that even a small card program generates a meaningful pool of personal data.
What to watch
The immediate checkpoint is Dec. 20, 2026, when branded cards stop authorizing transactions and the safeguards tied to the legacy system lapse. Between now and then, watch whether Gnosis Pay discloses how many customers were affected or the full categories of data taken, and whether data protection authorities in the relevant jurisdictions open inquiries. How quickly cardholders migrate to partner programs — and how the mandatory 3D Secure step affects online payment success — will also shape the final weeks of the consumer business.
Frequently Asked Questions
 What information was exposed in the Gnosis Pay breach?
Cointelegraph reported that breach notifications listed full card numbers, expiry dates, CVV codes, names, home addresses, wallet addresses, emails, phone numbers, nationalities and, in some cases, IBAN and BIC banking details. Gnosis Pay did not publicly list the categories itself.
 Were customer funds affected?
Gnosis Pay said customer funds were not affected and that its enterprise white-label card platform was untouched. The breach was limited to the consumer business behind Gnosis Pay-branded cards.
 When does Gnosis Pay stop supporting its branded cards?
The retirement notice issued Sept. 21 set the end of branded card services for 23:59 UTC on Dec. 20, 2026. The web app will retain withdrawal functionality, and assets remain in self-custodial Safe accounts.
 What should affected customers do?
Gnosis Pay advised avoiding links in unexpected messages and opening the official web app or partner app directly. It said neither it nor partners will request seed phrases, private keys, PINs or full card numbers.
This post Gnosis Pay reports data breach ahead of Dec. 20 card shutdown first appeared on BitcoinWorld.