Crypto payment card provider Gnosis Pay discloses unauthorized access to its white-label card system on November 3, with sensitive information leaked
Crypto payment card provider Gnosis Pay disclosed on November 6 that on November 3 it discovered that someone had unauthorized access to its white-label card business system (the B2C business line). The company’s security team began containment within 2 hours of detection, then replaced the affected security credentials and fixed the vulnerability.
According to user notifications and related reports, the leaked information included full card numbers, expiration dates, CVV security codes, names, home addresses, and associated crypto wallet addresses, and in some cases also included banking information such as email addresses, phone numbers, nationalities, and IBANs. Gnosis Pay said user funds were not transferred, and the incident affected only its white-label card system; the enterprise white-label card issuance platform was not affected.
The company has notified affected users and has forcibly enabled 3D Secure for all online card transactions, a measure that will remain in place until the legacy B2C system is retired as planned on December 20. Gnosis Pay warned users not to provide anyone with seed phrases, private keys, PINs, or full card numbers, and not to transfer funds according to instructions from unknown calls or messages.
Original source:
Title: Data breach on the legacy system powering Gnosis Pay-branded cards Publisher: Gnosis Pay Publication date: 2026-11-06 URL: https://gnosispay.com/blog/data-breach-legacy-system-gnosis-pay-branded-cards Source type: official company announcement Verification status: This read of the official blog and Cointelegraph confirmed, verification date 2026-11-06 Supporting content: Supports all detection timing, containment measures, fund safety, and 3D Secure arrangements in the body
ABAB AI Insight
Crypto payment card provider Gnosis Pay disclosed on November 6 that it discovered unauthorized access to its white-label card business system on November 3. The company’s security team began containment within 2 hours of detection, then replaced the affected security credentials and fixed the vulnerability. User funds were not transferred.
In terms of data and system path, the leaked information included full card numbers, expiration dates, CVV security codes, names, home addresses, and associated crypto wallet addresses. The incident affected only the white-label card system, and the enterprise white-label card issuance platform was not affected. The B2C system was originally scheduled to be retired on December 20. The company has forcibly enabled 3D Secure for all online card transactions until the system is retired. Gnosis Pay has notified affected users and reported to partners, data protection authorities, and issuers.
Compared with the enterprise platform being unaffected, this incident was limited to the consumer system that is about to be retired. The similarity is that both involve card data; the key difference is that the white-label card system exposed the linkage between card numbers and on-chain addresses, while the white-label platform was not affected. Names, addresses, and wallet addresses were linked to one another, which may increase the risk of targeted fraud.
For Gnosis Pay, the incident occurred before the system was retired, and the company has taken containment and forced verification measures. For users, they need to be alert to phishing messages using real information and must not provide seed phrases or full card numbers. For the industry, this incident shows that legacy systems nearing retirement can still become targets, and the linkage between card data and on-chain addresses increases risk.
ABAB News · Cognitive Law
Gnosis Pay detected unauthorized access to its white-label card system on November 3 and began containment within 2 hours.
The leaked information included full card numbers, CVVs, names, addresses, and linked wallet addresses, and funds were not affected.
The company has forcibly enabled 3D Secure for online transactions until the B2C system is retired on December 20.