TLDR
- Gnosis Pay detected unauthorized access to its legacy consumer card system on November 3, 2026.
- The security incident exposed customer information, although the company reported no loss of customer funds.
- Gnosis Pay introduced mandatory 3D Secure verification for all online card payments.
- The company confirmed that its enterprise white-label card platform remained unaffected by the breach.
- Gnosis Pay notified affected customers and began communicating with relevant data protection authorities.
Gnosis Pay has mandated 3D Secure checks for online card payments following a customer data breach. The company detected unauthorized access to its legacy consumer card system on November 3, 2026. It disclosed the incident on November 6, confirming that some customer information was exposed. The added checks will remain until December 20, when Gnosis Pay plans to retire that system. The company said customer funds and its separate enterprise card platform were unaffected.
Extra Verification Remains Until December Shutdown
Gnosis Pay said its security team began containment within two hours of detection. The company replaced affected credentials and addressed the underlying vulnerability. It also increased monitoring of cards and wallets for fraud and attempted access to customer funds. Mandatory 3D Secure adds an identity-verification step to online card purchases.
The safeguards apply during the remaining life of the legacy consumer operation. Gnosis Pay had already announced plans to discontinue consumer interfaces and shift users toward partner applications. The company said its enterprise platform, which powers white-label card programs, was unaffected. That distinction limits the confirmed exposure to the older consumer system, not every Gnosis Pay integration.
Company Notifies Customers and Privacy Authorities
Gnosis Pay said it emailed each affected customer on November 6. Those messages detailed the information accessed from individual accounts. The public statement did not specify the number of affected users or all exposed data categories. It also did not identify the intruder or explain how unauthorized access was obtained.
The company notified partners and began communicating with relevant data protection authorities and its card issuer. It is reviewing the incident and arranging specialist monitoring for possible misuse of exposed information. Gnosis Pay warned customers against unexpected messages containing personal details or genuine card purchases. It said legitimate support would never request seed phrases, private keys, PINs, or complete card numbers.
Data Obligations Continue After Consumer Card Retirement
The December shutdown does not mean Gnosis Pay will immediately erase all customer records. Its published data guidance says identity and transaction records remain for five years after account closure. Support correspondence is retained for six years. Customers can export card transaction histories through the consumer web app until December 20. After that, they must request records directly from the company.
Gnosis Pay says blockchain explorers cannot show merchant names or card-level transaction details. Customers therefore cannot replace a card-history export with on-chain records. The disclosure concerns customer information, not the separate June smart-contract exploit affecting Gnosis Pay wallets. Gnosis previously confirmed that it restored funds lost in that incident.
