Gnosis Pay Reports Unauthorized Access to Customer Data on Legacy Card System

Crypto card provider Gnosis Pay disclosed on Friday that hackers gained unauthorized access to customer information stored on the legacy system supporting its branded cards. The incident is the latest in a series of security challenges facing the broader cryptocurrency industry. While users often search for a reliable crypto card, this event highlights the ongoing risks associated with digital asset management platforms.

The company stated that its internal monitoring systems identified the breach on November 3. Upon detection, Gnosis Pay initiated containment protocols within two hours, replaced compromised security credentials, and addressed the underlying vulnerability. According to the firm, customer funds were not impacted by the unauthorized access.

Gnosis Pay confirmed a data breach on its consumer card platform, though user funds remain unaffected.

The breach was restricted to Gnosis Pay’s consumer-facing business line, which was already scheduled for decommissioning on December 20. The company’s enterprise platform, which provides white-label card infrastructure for neobanks, fintech firms, and various wallets, remained secure and was not affected by the incident. Gnosis Pay has not disclosed the total number of affected customers or the specific types of data exposed, but it confirmed that all impacted individuals have been notified via email.

Enhanced Security Measures

To mitigate further risks, Gnosis Pay has implemented mandatory 3D Secure verification for all online card transactions until the consumer platform is retired. The company has also increased monitoring of card activity and wallets to detect potential fraudulent behavior. Furthermore, the firm has notified its card issuer, business partners, and relevant data protection authorities regarding the incident. It is currently arranging specialized monitoring services to assist affected users in identifying potential data misuse.

Customers are advised to remain vigilant against suspicious communications, even those that may appear legitimate or contain personal details. Gnosis Pay emphasized that it will never request seed phrases, PINs, full card numbers, or ask users to transfer funds. Users are also cautioned against sharing sensitive information regarding their physical addresses or cryptocurrency holdings, as physical threats against crypto holders have been on the rise globally.

Why it matters

This security incident highlights the vulnerabilities inherent in legacy systems within the digital asset sector. While Gnosis Pay’s enterprise services remain secure, the breach serves as a reminder for users to exercise caution when sharing personal data. For users in India and South Asia, where interest in digital payment solutions is growing, this event underscores the importance of utilizing platforms with robust, updated security protocols and remaining wary of phishing attempts targeting financial credentials.