A card that says too much. Gnosis Pay connects a wallet to a Visa card accepted by merchants. The service was born in the Gnosis ecosystem, whose blockchain has become a rollup. On November 6, the company announced a data leak on its card system: unauthorized access exposed customer information.
The key points of this article:
Gnosis Pay detected unauthorized access on November 3 to its personal card system.
According to initial reports, the leak covers names, postal addresses and data linked to wallets.
The company says it began containing the intrusion in less than two hours, with no loss of funds.
The affected system was scheduled to shut down on December 20, and partner cards are not affected.
A leak on a system already promised to close
On November 3, Gnosis Pay's monitoring tools detected unauthorized access to the system that powers its cards, and the security team took over without delay.
Containment begins in less than two hours, the security identifiers concerned are then replaced, and the vulnerability closed.
In its announcement, Gnosis Pay mentions names, postal addresses and data attached to the wallets.
The press release does not say how many customers the leak affects, and three days pass between detection and public announcement. Each affected customer received by email the exact list of information taken from their account.
The data exposed is more sensitive than a simple list of email addresses. A crypto card connects a verified identity to an on-chain wallet, the balance of which remains readable by everyone on an explorer, and the pseudonymity of the customers concerned suddenly disappears.
For example, an attacker who knows a customer's address and assets can prepare a tailor-made scam. He slips in just the right amount of true details to trap his target.
The leak remains confined to the general public system, which was promised to be shut down on December 20 anyway. The corporate platform, which powers white label card programs, remains spared.
Should you be worried about your funds?
No, replies the company in its press release. The incident did not cost customers any funds, and the protection of personal data is as important as that of money, acknowledges Gnosis Pay.
Gnosis Pay has strengthened monitoring of cards and wallets to spot any fraud attempts, and specialized monitoring will look for any reuse of exposed data.
3D Secure is now mandatory for all online card payments, an additional validation, often by code, when paying.
The company also alerted its partners, its card issuer and data protection authorities. These measures will remain in place until the service is stopped, scheduled for December 20.
The main risk is downstream, where fresh personal data fuels phishing, such as the fake emails that targeted the Bitcoin Passport wallet at the end of October.
A message that cites a real name and a real purchase is no more legitimate. Gnosis Pay advises not to open their links and to go through its official application.
The seed phrase, PIN code and full card number are never shared. The service will not request them in any message.
