Overview
- Gnosis Pay said its monitoring detected unauthorized access on Tuesday, Nov. 3, and that containment began within two hours while the company replaced compromised credentials and patched the vulnerability.
- The company says the intrusion was limited to its legacy consumer card system and that customer funds and its enterprise white‑label platform were not accessed.
- Gnosis Pay emailed each affected customer on Nov. 6 with account‑specific details but has not published a total number of affected users or a comprehensive list of the data fields exposed.
- The firm made 3D Secure mandatory for all online card payments until the legacy system retires on Dec. 20, 2026, with 3D Secure adding an issuer‑side identity check before online purchases can be completed.
- Journalists and shared customer notices report exposed fields may include full card numbers, CVV codes, home addresses and wallet addresses, a mix that raises risks of targeted phishing and physical threats and will persist because company data‑retention policies keep records after shutdown.