Breach Exposes Some Gnosis Pay Customers’ Information in Consumer Card System
Key Facts
Gnosis Pay said monitoring systems detected unauthorized access on November 3, 2026, to the system that operates its branded cards, exposing some customer information. The company said in a statement that the incident affected its consumer card business, while users’ funds were unaffected. Its security team began containment measures within two hours of detecting the access, then replaced the affected credentials and fixed the vulnerability. The company said protecting personal information remains as important as protecting customers’ funds. Its public announcement did not identify the categories of information exposed or the number of customers affected, but said each affected customer received a message explaining what information had been taken from their account.
Gnosis Pay’s statement limited the breach to the system operating its branded cards, and said that system was scheduled to be retired on December 20, 2026. It added that its corporate platform for running white-label card programs was unaffected. This comes as the company said in an earlier announcement that its new corporate platform was already operating and partners had been using it since earlier in the year. The distinction places the incident in the consumer card system set to be discontinued, rather than the partner-program platform. The company confirmed that the affected system serves its consumer business.
The company said it made additional 3D Secure verification mandatory for all online card payments. The measure will remain in place until the planned retirement of the consumer card system on December 20, 2026. It also said it replaced the affected credentials and fixed the vulnerability after containment began. According to its statement, it emailed each affected customer explaining what information had been taken from their account. The company notified its partners and began contacting the relevant data protection authorities and its card issuer.
Gnosis Pay warned customers about unexpected emails, texts, calls and letters concerning the company, partner apps or the card, even if they included correct data or details of a real purchase. It advised them not to open links in those messages and to go directly to the official app. The company said it and its partners would never ask for a recovery phrase, private keys, PIN or full card number. It also warned against any request to transfer money by email, message or phone. It confirmed that all affected customers had received an email and urged anyone with concerns to contact its support team.
The company said it is conducting a full review of the incident, applying its findings across its systems and arranging specialist monitoring to detect any misuse of the exposed information. Gnosis Pay had announced in September that it was shifting toward a platform for managing corporate card programs, with partners already operating on the new platform before that announcement. The November incident differs from a separate exploit in June 2026, when attackers exploited a vulnerability in software modules linked to Gnosis Pay’s card wallet infrastructure, putting some wallets and funds at risk. Gnosis estimated in its review of that exploit that attackers extracted $1.5 million, while a further $300,000 was inaccessible. It said at the time that all funds had been returned to users and services had been restored for 99% of them on June 6, before the remaining accounts were recovered early the following week.
In the market, Visa shares closed at $422.59 on November 5, 2026, according to EL7 data. The closing data cited in the evidence do not include Mastercard or American Express share prices for that day. Gnosis Pay’s official page says Monavate Limited issues the card under a license from Visa Europe Limited. The page says Monavate is an electronic money institution licensed and regulated by the UK Financial Conduct Authority, with registration number 901097. Gnosis Pay’s next announced step is to complete its breach review and monitor for potential misuse of information, while additional verification remains in place until the consumer system’s retirement on December 20, 2026.