Gnosis Pay Detects Breach of Consumer Card System, Begins Containment Within Two Hours
Key Facts
Gnosis Pay said monitoring systems detected unauthorized access on November 3, 2026, to the system that runs its branded cards for its consumer business. The company said the incident exposed "some customer information" but did not publish a consolidated list of the data affected. It said it informed each affected customer individually about the information taken from their account. Customer funds were not affected, it said, but added that the security of personal information was no less important. This distinction separates the safety of users' balances from the exposure of their personal data.
Gnosis Pay said its security team began containing the incident within two hours of discovering it. The company later replaced the affected security credentials and addressed the vulnerability, it added. It described the breach as confined to the system running its consumer cards. The company said its business platform, which manages card programs bearing partners' brands, including programs provided to other entities, was unaffected. According to the company's account, this means the incident did not extend to the infrastructure running white-label card programs.
Gnosis Pay did not publicly disclose how many customers were affected or the types of data exposed, according to a report published by Decrypt. In its statement, the company referred only to "some customer information" and sent different details to each affected customer by email. The published information therefore does not include a public list covering all accounts or precisely identify the data elements the attackers may have accessed. The company said it notified its partners of the breach and is in contact with relevant data-protection authorities and its card issuer. It is also arranging specialized monitoring to detect any signs of misuse of the stolen information.
As an immediate measure, the company made additional 3D Secure verification mandatory for all online card payments. It said the measure will remain in place until the consumer system is retired, as scheduled, on December 20, 2026. The company added that it had increased monitoring of card and wallet activity to detect fraud or attempts to access users' funds. It urged customers to be cautious of any unexpected message, call or letter concerning Gnosis Pay, a partner app or the card. It warned that a message may contain genuine personal details or refer to an actual purchase, which does not make it trustworthy.
The breach comes as the company had previously announced plans to end its consumer services and focus on business card programs. Gnosis Pay said it shifted in 2025 from a focus on consumer cards to providing card programs for digital wallets, fintech companies and neobanks. It added that this part of its business is growing and that it cannot maintain consumer interfaces to its desired standard alongside it. Under the official notice, cards will stop processing transactions at 23:59 UTC on December 20, 2026, and other app functions will also close on that date. Withdrawals will remain available through the app after the card and other functions are discontinued.
The incident brings renewed attention to a separate event involving infrastructure linked to Gnosis Pay cards in June 2026. Gnosis said at the time that attackers exploited a vulnerability in software modules used in the cards' secure infrastructure and extracted $1.5 million, while access to a further approximately $300,000 was lost. The company said it absorbed the losses and reimbursed users, and that services had returned to 99% of users by June 6, with the remaining accounts restored the following week. The GnosisDAO report for the second quarter recorded 561,252 payments worth $26,420,000, down 0.4% and 3.6%, respectively, compared with the first quarter. The report linked a service outage lasting several days in June to a critical bug, in an incident separate from the data breach the company announced in November.