Gnosis Pay Says Breach Exposed Customer Data, Including One User’s Address and Card Details
Summary
Gnosis Pay says an attacker accessed its consumer card system on Nov. 3 and took customer data. One customer reported exposure of his address, card details and wallet addresses; scope and entry method remain undisclosed. Partner-app cards were reportedly unaffected.
Key points
- Gnosis Pay says it detected unauthorized access to the system behind its branded consumer cards on Nov. 3 and disclosed the incident on Nov. 6.
- The company has not disclosed how many customers were affected, what data was taken overall or how the attacker gained access.
- Rotki founder Lefteris Karapetsas shared a notice indicating that his home address, card details and wallet addresses were exposed; this is one customer’s reported notice, not a confirmed account of all affected data.
- Gnosis Pay says its security team began containment within two hours, replaced affected credentials and addressed the vulnerability. It says partner-app cards on a separate enterprise platform were not affected.
- The company says it is monitoring card activity and wallets more closely and has made 3D Secure mandatory for online card payments while the consumer system remains active.
- Gnosis Pay’s branded consumer card system is scheduled to shut down on Dec. 20, 2026; the company says partner-app cards were not affected by this incident.
Article Details
- Victim Organization
- Gnosis Pay
- Incident Type
- Unauthorized access to the consumer system for Gnosis Pay-branded cards, resulting in customer data theft
- Disclosure Date
- 2026-11-06
- Data Types Exposed
- A customer who shared their notice said the exposed data included their home address, card details, and wallet addresses; Gnosis Pay has not publicly specified the data exposed across affected accounts.
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Gnosis Pay said its security team began containment within two hours, replaced affected credentials, and addressed the vulnerability. It increased monitoring of card activity and wallets and made 3D Secure mandatory for online card payments. The company said no funds were affected in this breach. Partner-app cards on a separate enterprise platform were reportedly not affected.
- Claim Status
- confirmed
People
Vendors
MonavateThe company has informed its partners, its card issuer Monavate, an e-money institution regulated by the UK’s Financial Conduct Authority, and “the applicable data protection authorities”.SumsubTo order one, customers went through identity checks with the verification company Sumsub, with document uploads, a phone number and questions about the source of their funds, Gnosis Pay’s developer documentation shows.