Gnosis Pay breach exposes card details, personal data and crypto wallet information

Crypto-linked Visa debit card provider Gnosis Pay disclosed a security breach on Friday that exposed customers’ payment card details, home addresses and cryptocurrency wallet addresses.

Gnosis Pay said it detected unauthorized access to its legacy consumer card system on Nov. 3 and began containing the breach within two hours. The company said customer funds and its separate enterprise platform, which powers white-label card programs, were unaffected.

According to breach notifications reviewed by Cointelegraph, the company identified exposed information including full payment card numbers, expiration dates, CVV codes, customer names, home addresses and wallet addresses linked to affected accounts. The compromised data also included email addresses, phone numbers, nationalities and, in some cases, banking details such as IBAN and BIC information.

Gnosis Pay customer shares a breach notification detailing exposed personal and financial data. Source: Lefteris Karapetsas

One notification also confirmed that the customer’s card was canceled on Nov. 3, with no suspicious transactions or movement of funds detected.

Gnosis Pay said it replaced compromised security credentials, addressed the vulnerability and made 3D Secure verification mandatory for online payments until the legacy system’s planned retirement on Dec. 20. It also warned customers about phishing attempts using their personal or transaction details and said it was arranging monitoring for potential misuse of the stolen data.

According to data from OpenRate, a third-party platform tracking crypto card activity, Gnosis Pay had around 2,400 daily active cardholders and processed $263,200 in transactions over the previous 24 hours.

The company did not disclose how many customers were affected and did not immediately respond to Cointelegraph’s request for comment.