Gnosis Pay Data Breach Exposes Customer Information

Crypto Card Provider Gnosis Pay Says Hackers Accessed Customer Data

Crypto debit card provider Gnosis Pay has disclosed a data breach involving its consumer-facing, branded card program, saying attackers gained unauthorized access to customer information stored on a legacy system supporting those cards.

The company said customer funds were not affected and emphasized that its enterprise card platform—which underpins partner and corporate card programs—was not impacted.

According to Gnosis Pay, its monitoring systems detected the unauthorized access on Nov. 3 and the incident was contained within two hours. The company said it has since replaced compromised security credentials and fixed the underlying vulnerability.

Gnosis Pay said it notified partners, its card issuer, and data protection authorities. It also said it is arranging specialist monitoring for signs the exposed data is being misused.

The company stated that affected customers were sent emails describing which specific data from their accounts was accessed. It has not publicly disclosed how many users were affected as of Nov. 6, 2026.

While Gnosis Pay said funds were not impacted, the breach matters because exposed customer information can increase the risk of targeted phishing and scams. One user cited in coverage said the accessed information linked real-world identifiers, such as a home address and card details, to crypto wallets connected to the account—data that could make social engineering attempts more convincing.

As a short-term safeguard, Gnosis Pay said it has increased monitoring of card activity and wallets for fraud and made 3D Secure—an additional verification step—mandatory for online card payments until its consumer platform is retired.

The incident also arrives shortly before the company plans to shut down its branded cards on Dec. 20 as it focuses on partner programs. The disclosure adds to a broader pattern of security incidents across the crypto sector, including cases where customer information has been exposed through third-party or ancillary systems even when core funds and platforms remain unaffected.

• What happened: Unauthorized access to the legacy system behind Gnosis Pay-branded consumer cards, with customer data viewed.
• When: Detected on Nov. 3; confirmed publicly on Nov. 6, 2026.
• What wasn’t affected: Customer funds and the enterprise card platform supporting partner programs.
• What’s changing: Mandatory 3D Secure for online payments and heightened fraud monitoring until the consumer platform is retired.