Gnosis Pay discloses data breach on legacy card system

The company detected unauthorized access on November 3, began containment within two hours, and later replaced affected security credentials and addressed the vulnerability. The disclosure limits the incident to the consumer business line, with Gnosis Pay stating its enterprise platform, which powers white-label card programs, remains unaffected. The company also claims customer funds were unaffected, though wallet balances have not been independently verified.

In response to the breach, Gnosis Pay has made 3D Secure verification mandatory for all online card payments and increased monitoring of card activity and wallets for fraud or attempts to access funds. These measures will remain until the consumer system is retired on December 20, 2026, a closure that was already scheduled before the breach occurred.

Customer Response

Gnosis Pay has emailed every affected customer with specific information taken from their accounts. While the public notice describes the exposure as customer information, it provides neither a complete list of affected data fields nor a customer count. The emails contain details of each customer's exposure and additional recommended actions.

A message can contain genuine personal details or a real purchase and still be suspect. We tell customers to avoid links in those messages and open the official web app or their partner app directly.

The company warns customers about unexpected emails, texts, calls and letters regarding Gnosis Pay, partner apps or cards. It emphasizes that neither Gnosis Pay nor partner apps will request seed phrases, private keys, PINs or full card numbers, nor ask customers to re-verify identity or move funds through these channels.

System Retirement

The legacy platform retirement was announced on September 21, 2026, before this incident. Both physical and virtual Gnosis Pay cards will stop authorizing transactions at 23:59 UTC on December 20, 2026, while the consumer web app will close at the same time except for withdrawals. Customers who do nothing will lose access to card payments at that deadline, regardless of whether they join a partner program.

The retirement represents a shift away from consumer-facing services toward enterprise card programs. Joining a partner program requires a new contract with different eligibility rules, supported currencies and blockchains, foreign-exchange arrangements, limits, fees and rewards. Existing card terms do not automatically carry across.

Customers must accept new terms and confirm deactivation of their existing card and termination of its agreement. They must also create a new Safe separate from their current account and fund it themselves. Subscriptions and recurring card payments will fail after the old card stops working, requiring customers to update details with each merchant.

Continued Access

Under the retirement notice, the existing Safe remains a self-custodial smart-contract account on Gnosis Chain. Customers retain ownership and access to their assets, keeping their signer key and able to use compatible third-party Safe interfaces. The web app's withdrawal function will remain available after closure.

An existing euro IBAN continues operating after the card closes, linked to the wallet and provided by Monerium rather than Gnosis Pay. Customers also preserve rights concerning unauthorized transactions, chargebacks, and refunds, with individual card-scheme deadlines still applying. General cardholder support ends on June 18, 2027, while support for refunds and disputes continues until June 12, 2028.

Monavate handles payment-service complaints under the cardholder contract, with aims to provide a final response within 15 business days, or 35 business days if delays occur. Gnosis Pay has not published a completion date for its breach review or a full technical account of how the unauthorized access occurred.