Overview
- Gnosis Pay detected unauthorized access to its legacy consumer card system on Tuesday, Nov. 3 and publicly disclosed the incident on Friday, Nov. 6.
- The company says the breach exposed certain customer information but did not result in any loss of customer funds and its enterprise white‑label platform was not affected.
- As immediate mitigations Gnosis Pay replaced compromised credentials, patched the vulnerability, increased fraud monitoring and made 3D Secure mandatory for all online card payments until the system retires on Dec. 20.
- Affected customers were emailed account-specific details on Nov. 6 but Gnosis Pay has not published a total count of impacted users or a comprehensive list of exposed data fields reported in some notices such as full card numbers, CVVs, addresses and wallet addresses.
- Customers can export transaction histories from the consumer web app until Dec. 20 and the company has reported the breach to its card issuer, partners and data protection authorities while arranging specialist monitoring for misuse of exposed data.