Breach Exposes Gnosis Pay Customer Data in Consumer Card System
Key Facts
Gnosis Pay said its monitoring systems detected unauthorized access on November 3, 2026, to the system that operates its branded cards, exposing some customer information. The security team began containing the incident within two hours of its discovery, then replaced the affected credentials and fixed the vulnerability, according to a company statement published on November 6. The company said the breach was limited to the consumer card system and that user funds were unaffected. It also confirmed that its business platform, which operates white-label card programs, was not breached. The distinction places the incident in a system separate from the infrastructure business partners use to manage their programs.
The public announcement did not state how many customers were affected or which categories of data were exposed, while Gnosis Pay said it had sent each affected customer a message specifying what information was taken from their account. The company notified its partners and began contacting the relevant data protection authorities and the card issuer. The lack of figures and details in the announcement leaves the scope of exposure unclear to the public, while affected customers receive details individually. The company said it had added monitoring of card and wallet activity to detect fraud and attempts to access users’ funds. It also made additional 3D Secure verification mandatory for all online card payments.
The additional verification measures will remain in place until the planned retirement of the consumer card system on December 20, 2026, the company said. Gnosis Pay had previously said the card and web app would be discontinued on that date, while withdrawals through the app would remain available afterward. The shutdown date is part of a broader plan to end direct-to-consumer services and shift to managing card programs for businesses. The company said in announcing the transition that its new platform had been working with partners since earlier in the year. It added that the next phase includes moving existing partners to the platform and closing its consumer operation.
The new platform allows partners to design and launch card programs to suit their needs, with tools for card issuance, dispute management and customer service, according to Gnosis Pay. The company said cards are issued in cooperation with Monavate, which Gnosis Pay’s official website describes as an electronic money institution licensed and regulated by Britain’s Financial Conduct Authority, with registration number 901097. In announcing the transition, Gnosis Pay said the launch of the MiniPay card on the Celo network through the Opera wallet made its infrastructure available to more than 16 million activated wallets. The move reflects the company’s effort to expand the use of its infrastructure through partner programs. The business platform remains outside the scope of the consumer card system breach, according to the company statement.
Gnosis Pay warned customers about unexpected messages or calls related to their card, and advised them not to open links in them and to go directly to the official web app or partner app. The company said attackers could use accurate information or real transaction details to try to lure customers. It said the company and its partners would never ask for a seed phrase, private keys, PIN or full card number. It also warned against requests to transfer money by email, message or phone. The company urged customers with concerns to contact its support team and said it was arranging specialist monitoring to detect any misuse of the exposed information.
The data exposure is distinct from a separate security exploit that began on June 1, 2026, and targeted software modules linked to Gnosis Pay’s card wallet infrastructure, according to a Gnosis review. The company said at the time that attackers extracted $1.5 million and that about $300,000 more became inaccessible, with options for recovering it under exploration. Gnosis’s second-quarter report said the service had returned to 99% of users by June 6, and that the remaining accounts were restored early the following week. The report said users lost no money in that exploit. The breach disclosed in November concerns customer information in the consumer system, and the company said user funds were unaffected.
Gnosis Pay recorded 561,252 payments worth $26.42 million in the second quarter, compared with 563,561 payments and $27.39 million in the first quarter, according to Gnosis’s second-quarter report. Payment volume fell 3.6% quarter on quarter, while the number of payments declined 0.4%. The figures provide context on activity in the consumer service ahead of its announced shutdown, as the company focuses on moving partner programs to its new platform. Gnosis Pay said it was conducting a full review of the current incident and would apply what it learned to its systems. Specialist monitoring and additional verification measures will continue until the planned retirement of the consumer system on December 20, 2026.